CVE-2026-70629: FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in RSCC Decoder
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rsccdecodeframe() calls avimagecopyplane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflatedbuf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpeg libavcodec rscc decoder (libavcodec/rscc.c)to a version that resolves this vulnerability.Fixed in 9.0 - Compensating control
If you must run an affected FFmpeg version, restrict exposure of the RSCC decoding path in persistent decoding services by blocking/validating incoming crafted video inputs before they reach rscc_decode_frame() (e.g., reject files/streams whose RSCC tile geometry/decompression characteristics are inconsistent with declared tile dimensions).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70629?
The severity of CVE-2026-70629 is rated as medium with a CVSS score of 5.5.
How do I fix CVE-2026-70629?
To fix CVE-2026-70629, update FFmpeg to version 9.0 or later.
What does CVE-2026-70629 affect?
CVE-2026-70629 affects FFmpeg versions from 3.0 up to, but not including, 9.0.
What type of vulnerability is CVE-2026-70629?
CVE-2026-70629 is an uninitialized heap memory read vulnerability found in the RSCC decoder.
Can CVE-2026-70629 lead to data exposure?
Yes, CVE-2026-70629 allows attackers to disclose heap memory contents by using specially crafted video files.