CVE-2026-70631: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-70631 is an uninitialized heap memory disclosure vulnerability in FFmpeg's native TIFF decoder (libavcodec/tiff.c). It affects FFmpeg versions from 0.5 up to, but not including, 9.0. An attacker who can cause FFmpeg to decode a crafted TIFF file may expose stale heap memory contents, potentially leaking sensitive data from persistent services. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.8 (Medium) (GitHub Advisory). The vulnerability was published on August 6, 2026, and a patch was added to the GitHub Advisory Database on August 7, 2026 (GitHub Advisory).

The root cause is classified as CWE-908 (Use of Uninitialized Resource). The tiff_unpack_zlib() function in libavcodec/tiff.c allocates a heap buffer sized for the full declared strip of a TIFF image, but then copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed. An attacker can craft a valid Deflate-compressed TIFF strip that terminates successfully after producing fewer bytes than declared, causing the unwritten portion of the heap buffer — which may contain stale data from prior allocations — to be incorporated into the decoded image output. Exploitation requires local access and user interaction (i.e., a user or service must be induced to process the malicious TIFF file), with no privileges required (GitHub Advisory). Relevant fix commits are available at the FFmpeg repository (GitHub Advisory).

Successful exploitation results in a high confidentiality impact with no integrity or availability impact. An attacker can read stale heap memory data that may contain sensitive information — such as cryptographic keys, credentials, or other process data — from prior heap allocations within the FFmpeg process. The risk is most significant in persistent services (e.g., media processing pipelines, transcoding servers) where sensitive data from earlier operations may remain in heap memory and be exposed through the decoded image output (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.135% (3rd percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and SSVC assessment classifies exploitation as "none" with technical impact as "partial" (GitHub Advisory).

1. Craft a malicious TIFF file: Create a TIFF file containing a Deflate-compressed strip (using the TIFF Compression tag value 8/32946) where the compressed data decompresses to fewer bytes than the declared strip size (rows × columns × samples per pixel).
2. Ensure valid zlib stream: The crafted zlib/Deflate stream must be structurally valid and terminate successfully (with a valid checksum), so FFmpeg's zlib decompression does not return an error — it simply produces fewer output bytes than expected.
3. Deliver the file to FFmpeg: Induce the target FFmpeg instance or application to decode the crafted TIFF file, for example by uploading it to a media processing service, sending it as an email attachment processed by a server-side pipeline, or social-engineering a user into opening it.
4. Trigger heap memory disclosure: When tiff_unpack_zlib() calls memcpy() to copy all declared rows from the heap buffer into the output image, the unwritten bytes (containing stale heap data from prior allocations) are included in the decoded image output.
5. Extract leaked data: Retrieve the decoded image output (e.g., via a service's API response or output file) and analyze the pixel data in the region corresponding to the undecompressed portion of the strip for sensitive information such as keys, tokens, or other process memory artifacts (GitHub Advisory).

• File System: Unexpected or anomalous TIFF files submitted to FFmpeg-based processing services, particularly those with Deflate compression (compression tag 8 or 32946) and declared strip sizes inconsistent with actual compressed data size.
• Logs: FFmpeg processing logs showing successful decoding of TIFF files without errors despite compressed data size mismatches; unusual output image files with unexpected pixel data in strip regions.
• Process: FFmpeg processes handling TIFF files from untrusted or external sources in persistent/long-running service contexts where heap memory from prior sensitive operations may be present.

Upgrade FFmpeg to version 9.0 or later, which contains the fix for this vulnerability (GitHub Advisory). The fix is available via commits a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7, 2f234ea34c81288e3840fca632dd16481d8de39f, and 3c287af3affe1286350faa69c02bcc5d49de18bb in the FFmpeg repository. As an interim workaround, restrict FFmpeg processing to trusted TIFF sources only, and isolate FFmpeg services (e.g., via sandboxing or containerization) to minimize the sensitivity of data present in heap memory during TIFF decoding (GitHub Advisory).