CVE-2026-70630: FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in Screenpresso Decoder
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpressodecodeframe() function fails to validate the produced byte count before calling avimagecopyplane() to copy the complete frame dimensions from the persistent ctx->inflatedbuf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpeg libavcodec (screenpresso decoder)to a version that resolves this vulnerability.Fixed in 9.0 - Compensating control
Disable or avoid using the native Screenpresso decoder in FFmpeg for untrusted inputs, since the vulnerability is in libavcodec/screenpresso.c for FFmpeg versions >= 3.0 and < 9.0.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70630?
The severity of CVE-2026-70630 is classified as medium with a score of 5.5.
How do I fix CVE-2026-70630?
To fix CVE-2026-70630, upgrade your FFmpeg version to 9.0 or later.
What kind of vulnerability is CVE-2026-70630?
CVE-2026-70630 is an uninitialized heap memory read vulnerability in the Screenpresso decoder.
What effect can CVE-2026-70630 have on my system?
CVE-2026-70630 can allow attackers to recover sensitive memory contents by exploiting the vulnerability.
Which versions of FFmpeg are affected by CVE-2026-70630?
CVE-2026-70630 affects FFmpeg versions from 3.0 up to, but not including, 9.0.