CVE-2026-70629: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-70629 is an uninitialized heap memory read vulnerability in FFmpeg's native RSCC (Remote Screen Capture Codec) decoder, located in libavcodec/rscc.c. It affects FFmpeg versions from 3.0 up to, but not including, 9.0, and allows attackers to disclose heap memory contents by supplying a crafted video file. The vulnerability was published on August 6, 2026, with a patch advisory added to the GitHub Advisory Database on August 7, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.8 (Medium) (GitHub Advisory).

The root cause is classified as CWE-908 (Use of Uninitialized Resource). In rscc_decode_frame(), when processing a compressed tile, the function calls av_image_copy_plane() without first validating that the number of bytes decompressed from the tile matches the declared tile geometry (width × height × bytes-per-pixel). If a crafted video file causes the decompressor to produce fewer bytes than the tile dimensions require, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf — which may contain residual data from prior heap allocations or previously decoded frames — is copied directly into the output frame. This flaw is exploitable locally by tricking a user or service into decoding a maliciously crafted video file (GitHub Advisory). Relevant fix commits are available at the FFmpeg repository (FFmpeg Commit 1, FFmpeg Commit 2, FFmpeg Commit 3).

Successful exploitation results in a high-confidentiality impact: an attacker can read uninitialized heap memory contents, potentially exposing sensitive data from prior heap allocations or previously decoded video frames. This is particularly dangerous in persistent decoding services (e.g., media servers or transcoding pipelines) where the same process decodes multiple files, as residual data from earlier operations may include credentials, session tokens, or other sensitive in-memory content. There is no integrity or availability impact — the vulnerability is limited to information disclosure (GitHub Advisory).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable, requiring user interaction to trigger. The EPSS score is approximately 0.132% (3rd percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Craft a malicious RSCC video file: Create a video file using the RSCC codec format where a compressed tile is constructed to decompress fewer bytes than the declared tile geometry (width × height × bytes-per-pixel) requires. This can be achieved by manipulating the compressed tile data so the decompressor (e.g., zlib/LZ4) outputs a truncated payload.
2. Deliver the file to the target: Convince a local user or automated service (e.g., a media transcoder or video thumbnail generator) to open or process the crafted video file with a vulnerable FFmpeg version (3.0 ≤ version < 9.0).
3. Trigger the vulnerable code path: FFmpeg's rscc_decode_frame() processes the malicious tile, calls av_image_copy_plane() without validating the decompressed byte count, and copies the unwritten suffix of ctx->inflated_buf into the decoded output frame.
4. Extract disclosed memory: Retrieve the decoded output frame (e.g., via a decoded image file, network stream, or API response) and analyze the pixel data in the region corresponding to the under-decompressed tile for residual heap contents, which may include data from prior allocations or previously decoded frames (GitHub Advisory).

• File System: Presence of unexpected or anomalous .rscc, .avi, or other video container files in directories processed by FFmpeg-based services; files with unusually small compressed tile payloads relative to declared dimensions.
• Logs: FFmpeg stderr or application logs showing decoding of RSCC-format video files from untrusted or external sources; errors or warnings from the zlib/decompression layer indicating truncated output during RSCC tile processing.
• Process: FFmpeg or media processing processes consuming video files from user-supplied or network-accessible locations, particularly in persistent/long-running decoding service contexts where heap reuse is more likely to expose sensitive data.

The primary remediation is to upgrade FFmpeg to version 9.0 or later, which includes fixes applied via commits to libavcodec/rscc.c (FFmpeg PR #23895). For systems that cannot upgrade immediately, operators should avoid processing video files from untrusted sources using the RSCC decoder, and restrict access to video decoding services to trusted inputs only. In persistent decoding service environments, consider process isolation or sandboxing to limit the sensitivity of data that could be exposed via heap memory disclosure (GitHub Advisory).

The vulnerability was assigned and disclosed by VulnCheck and published to the GitHub Advisory Database on August 7, 2026. Tenable has released Nessus detection plugins (IDs 333302 and 335157) for this vulnerability. The Yocto Project security mailing list also flagged the issue for embedded Linux maintainers. No significant public researcher commentary or social media discussion has been observed beyond standard vulnerability tracking and scanner coverage.