CVE-2026-70630 in FFmpeg
Summary
by MITRE • 08/07/2026
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability under discussion represents a critical uninitialized memory read flaw in FFmpeg's Screenpresso decoder component affecting versions 3.0 through 8.9. This issue resides within the native Screenpresso decoder implementation located in libavcodec/screenpresso.c and specifically manifests during frame decompression operations. The vulnerability stems from inadequate input validation within the screenpresso_decode_frame() function where the system fails to properly verify the actual byte count produced by the zlib decompression process before proceeding with memory copying operations.
The technical exploitation of this vulnerability occurs when an attacker crafts a malicious SPV1 packet containing a valid zlib stream that decompresses to fewer bytes than required for a complete frame. This discrepancy creates a scenario where the decoder's internal buffer ctx->inflated_buf contains uninitialized heap memory from previous allocations or prior frame processing cycles. The function's failure to validate the decompressed byte count leads to a direct call to av_image_copy_plane() which copies the full frame dimensions from the persistent buffer regardless of whether all bytes have been properly initialized. This fundamental flaw results in sensitive data leakage where unwritten heap memory containing potentially confidential information such as userspace addresses from persistent decoding services gets inadvertently copied into the decoded output frames.
From a cybersecurity perspective, this vulnerability aligns with CWE-457: Use of Uninitialized Variable and represents a classic example of uninitialized memory access patterns that can lead to information disclosure attacks. The operational impact extends beyond simple data leakage as it provides attackers with potential insights into memory layout structures and system state information that could aid in subsequent exploitation attempts. The persistent nature of the buffer context means that sensitive information from previous processing cycles remains accessible, creating a continuous risk surface for attackers who can repeatedly exploit this vulnerability to harvest valuable memory contents over time.
The security implications of this vulnerability are particularly concerning given FFmpeg's widespread adoption across various platforms and applications including media players, content management systems, and streaming services. Attackers could leverage this flaw to extract sensitive data from running processes or persistent decoding services, potentially exposing system architecture details that would otherwise remain hidden. This memory disclosure capability can be instrumental in advanced exploitation techniques where knowledge of memory layout helps bypass security mitigations such as address space layout randomization. The vulnerability's classification under ATT&CK tactic TA0007 (Discovery) and technique T1069.001 (Permission Groups Discovery) demonstrates its potential for reconnaissance activities that could lead to more sophisticated attacks targeting system integrity and confidentiality.
Mitigation strategies should focus on implementing proper input validation within the screenpresso_decode_frame() function to ensure that decompressed byte counts match expected frame dimensions before proceeding with memory operations. The most effective approach involves adding explicit validation checks that verify the actual number of bytes produced by zlib decompression against the required frame size, preventing the copying of uninitialized memory regions. System administrators should also consider implementing network-level restrictions and input sanitization measures to prevent malicious SPV1 packets from reaching vulnerable FFmpeg implementations. Additionally, regular updates to FFmpeg versions containing patched Screenpresso decoder implementations remain crucial for maintaining system security posture and eliminating this specific vulnerability threat vector.