CVE-2026-70632: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-70632 is a heap out-of-bounds write vulnerability in FFmpeg's native GoPro CineForm HD (CFHD) decoder that can be escalated to arbitrary code execution. It affects FFmpeg versions 4.4 through 8.x (up to, but not including, 9.0). The vulnerability was published on August 6, 2026, with a patch advisory added to the GitHub Advisory Database on August 7, 2026. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (GitHub Advisory).

The root cause is an out-of-bounds write (CWE-787) in the cfhd_decode() function within FFmpeg's CFHD decoder. Specifically, the function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer. An attacker can trigger this by supplying a crafted AVI file during stream probing, requiring no privileges but necessitating user interaction (e.g., a user or automated pipeline opening the malicious file). The overflow can be escalated to arbitrary code execution by overwriting a live cleanup callback pointer in heap memory (GitHub Advisory). Patches are available via three commits to the FFmpeg repository (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to corrupt heap memory and achieve arbitrary code execution with the privileges of the FFmpeg process, resulting in high confidentiality, integrity, and availability impact on the affected system. An attacker who achieves code execution could exfiltrate sensitive data, modify files, or use the compromised process as a foothold for lateral movement within the environment. Applications and services that automatically process or probe user-supplied media files (e.g., media servers, transcoding pipelines, video editing tools) are at elevated risk (GitHub Advisory).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment confirms exploitation is currently "none" and the vulnerability is not automatable, as it requires user interaction to trigger stream probing of a malicious AVI file. The EPSS score is approximately 0.209% (11th percentile), indicating a low near-term probability of exploitation. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Craft malicious AVI file: Create a specially crafted AVI file containing a malformed GoPro CineForm HD (CFHD) video stream. The file must be structured to trigger the transform-type-2 reconstruction path in cfhd_decode() with a non-Bayer output width that violates the expected invariant.
2. Deliver the file to the target: Distribute the crafted AVI file to a target user or system via email attachment, file share, web download, or by uploading it to a service that automatically processes media files with FFmpeg (e.g., a transcoding pipeline or media server).
3. Trigger stream probing: Cause FFmpeg to probe the malicious AVI file — this can occur automatically when FFmpeg opens the file for format detection, requiring no additional user action beyond opening or submitting the file.
4. Trigger heap overflow: During probing, cfhd_decode() invokes horiz_filter_clip(), which writes oversized 16-bit sample rows beyond the allocated output frame buffer, corrupting adjacent heap memory including a live cleanup callback pointer.
5. Achieve arbitrary code execution: By controlling the overwritten callback pointer (through heap layout manipulation), the attacker redirects execution flow to attacker-controlled code when the cleanup routine is invoked, executing arbitrary code with the privileges of the FFmpeg process (GitHub Advisory).

• File System: Presence of unexpected or suspicious AVI files in directories processed by FFmpeg; newly created files or scripts in directories writable by the FFmpeg process account.
• Process: Unusual child processes spawned by the FFmpeg process (e.g., shells, network utilities such as curl, wget, nc); FFmpeg processes consuming abnormally high memory or crashing with segmentation faults.
• Logs: Application or system logs showing FFmpeg crashes (SIGSEGV, SIGABRT) when processing AVI files; error messages referencing cfhd_decode or horiz_filter_clip in FFmpeg output.
• Network: Unexpected outbound network connections originating from the FFmpeg process or its parent application to unknown external IP addresses, potentially indicating post-exploitation callback activity.

The primary remediation is to upgrade FFmpeg to version 9.0 or later, which includes fixes applied via commits 1006a2151236f9235bf02822f263b3fb0532111e, db05df9d135fb56a4babb836d5e9f5c1d984e087, and 16b2049d4d5222db6cd7c031409058571c94f6a9 (GitHub Advisory). As interim mitigations: restrict FFmpeg from processing AVI or CFHD-encoded files from untrusted sources; apply sandboxing (e.g., seccomp, containers, or least-privilege service accounts) to FFmpeg processes to limit the blast radius of any code execution; and validate or filter media files from untrusted sources before passing them to FFmpeg.

The vulnerability was noted in a CISA vulnerability bulletin (SB26-222) and discussed in the Yocto Project security mailing list, indicating awareness in embedded/Linux distribution communities (CISA Bulletin, Yocto Security List). Tenable has published Nessus detection plugins (IDs 333305 and 335155) for this vulnerability. A mention was also observed on Mastodon via @thehackerwire, suggesting moderate community awareness. No major vendor statements or significant researcher commentary beyond the patch and advisory have been identified.