CVE-2026-70632: FFmpeg 4.4 < 9.0 Heap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing
FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhddecode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horizfilterclip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpegto a version that resolves this vulnerability.Fixed in 9.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70632?
CVE-2026-70632 has a severity score of 7.8, indicating a high risk level.
How do I fix CVE-2026-70632?
To fix CVE-2026-70632, upgrade FFmpeg to version 9.0 or later that includes the patch.
What type of vulnerability is CVE-2026-70632?
CVE-2026-70632 is an out-of-bounds heap write vulnerability affecting the CFHD decoder.
Who is affected by CVE-2026-70632?
All users of FFmpeg versions 4.4 through 8.x are vulnerable to CVE-2026-70632.
What can an attacker do with CVE-2026-70632?
An attacker can exploit CVE-2026-70632 to corrupt heap memory by using a crafted AVI file during stream probing.