CVE-2026-70630: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-70630 is an uninitialized heap memory read vulnerability in FFmpeg's native Screenpresso decoder (libavcodec/screenpresso.c). It affects FFmpeg versions from 3.0 up to, but not including, 9.0. The flaw allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. It was published on August 6, 2026, with a patch advisory added to the GitHub Advisory Database on August 7, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.8 (Medium) (GitHub Advisory).

The root cause is classified as CWE-908 (Use of Uninitialized Resource). The screenpresso_decode_frame() function in libavcodec/screenpresso.c fails to validate the byte count produced by a zlib decompression operation before invoking av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer. When a crafted SPV1 packet contains a valid zlib stream that decompresses fewer bytes than the full frame size, the function copies unwritten heap memory — from prior allocations or prior decoded frames — into the output buffer. Exploitation requires local access and user interaction (e.g., opening a malicious media file), with no privileges required. Patches are referenced in FFmpeg commits and pull request #23896 (GitHub Advisory).

Successful exploitation results in a high-confidentiality-impact memory disclosure with no integrity or availability impact. An attacker who can supply a crafted SPV1 media file to a vulnerable FFmpeg instance can read uninitialized or previously-allocated heap memory, potentially exposing sensitive data such as userspace memory addresses from persistent decoding services. This information could facilitate further attacks such as ASLR bypass in services that continuously process media. There is no direct path to code execution or data modification from this vulnerability alone (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.132% (3rd percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable.

1. Craft a malicious SPV1 media file: Create a Screenpresso SPV1 packet containing a valid zlib-compressed stream that, upon decompression, produces fewer bytes than the full frame dimensions require (e.g., width × height × bytes-per-pixel).
2. Deliver the file to the target: Provide the crafted file to a user or service running a vulnerable FFmpeg version (3.0–8.x), such as by embedding it in a media processing workflow or social-engineering a user into opening it.
3. Trigger decoding: FFmpeg's screenpresso_decode_frame() decompresses the zlib stream into ctx->inflated_buf, which is only partially filled.
4. Exploit missing validation: Because no byte-count validation occurs, av_image_copy_plane() copies the full frame dimensions from ctx->inflated_buf, including uninitialized or stale heap memory beyond the decompressed data.
5. Extract leaked memory: Inspect the decoded output frame (e.g., via a raw pixel dump or encoded output file) to recover heap contents, which may include userspace addresses useful for defeating ASLR in persistent decoding services (GitHub Advisory).

• File System: Presence of unexpected or anomalous .spv, .sps, or Screenpresso-format media files in directories processed by FFmpeg-based services.
• Logs: FFmpeg process logs showing decoding of SPV1/Screenpresso streams from untrusted or external sources; unusual zlib decompression warnings or short-read conditions in application logs.
• Process: FFmpeg or media-processing service instances consuming or outputting unexpectedly large or malformed frame buffers; processes reading media files from untrusted network shares or user-supplied paths.
• Network: Inbound delivery of .spv or Screenpresso-format files via email attachments, web uploads, or file-sharing services to systems running FFmpeg-based media pipelines.

The primary remediation is to upgrade FFmpeg to version 9.0 or later, which includes fixes addressing the missing byte-count validation in screenpresso_decode_frame(). Relevant patches are available in FFmpeg commits 9a3202a, 705890061, and c22667d0, as well as pull request #23896 (GitHub Advisory). For systems unable to upgrade immediately, restrict or disable processing of Screenpresso (SPV1) format media files, and avoid passing untrusted media files to FFmpeg. Implementing input validation to reject malformed or unexpected SPV1 packets before they reach the decoder is an additional defensive measure.

The vulnerability was flagged by Tenable's Nessus scanner (detection ID 335157) and tracked by the Yocto Project security mailing list, indicating awareness in embedded/build-system communities (Tenable Nessus). No significant public researcher commentary, vendor statements beyond the patch commits, or notable media coverage has been identified at this time.