CVE-2026-70632 in FFmpeg
Summary
by MITRE • 08/07/2026
FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability resides within the FFmpeg media processing framework and specifically targets the native GoPro CineForm HD (CFHD) decoder implementation. The flaw manifests as an out-of-bounds heap write condition that occurs during stream probing when processing specially crafted AVI files. The vulnerability is classified under CWE-787 Out-of-bounds Write, which represents a critical class of memory corruption vulnerabilities that can lead to arbitrary code execution. The issue affects FFmpeg versions starting from 4.4 through 8.x releases, making it a long-standing concern that impacts numerous systems relying on this popular multimedia processing library for video and audio handling.
The technical root cause lies within the cfhd_decode() function's insufficient validation of input parameters during the transform-type-2 reconstruction path. Specifically, the decoder fails to maintain the non-Bayer logical output-width invariant, which should prevent oversized memory operations. This failure allows the horiz_filter_clip() function to write 16-bit sample rows that exceed the boundaries of the allocated output frame buffer. The memory corruption occurs because the decoder does not properly validate or constrain the width parameter during horizontal filtering operations, leading to memory writes that extend far beyond intended buffer limits.
The operational impact of this vulnerability extends beyond simple memory corruption, creating potential pathways for remote code execution. Attackers can craft malicious AVI files that when processed by FFmpeg during stream probing, trigger the vulnerable code path and overwrite critical memory structures including cleanup callback pointers. This type of exploitation aligns with ATT&CK technique T1203 Exploitation for Client Execution, where adversaries leverage software vulnerabilities to execute arbitrary code on target systems. The vulnerability is particularly dangerous in environments where FFmpeg processes untrusted media content such as web applications, media servers, or content delivery networks.
Mitigation strategies should prioritize immediate version updates to FFmpeg 9.0 or later, which contain patches addressing this specific out-of-bounds write condition. Organizations should implement strict input validation and sanitization for all media files processed through FFmpeg, particularly in web-facing applications where user-uploaded content is common. Network segmentation and access controls can limit the potential impact of exploitation attempts. Additionally, implementing runtime protections such as address space layout randomization and stack canaries may provide additional defense-in-depth measures. Security monitoring should focus on detecting unusual memory allocation patterns or unexpected process behavior when handling media files, as these could indicate exploitation attempts targeting this vulnerability class.
The vulnerability demonstrates the critical importance of proper input validation in multimedia decoders, where malformed input parameters can lead to severe memory corruption issues. This flaw represents a classic example of how insufficient bounds checking in low-level processing functions can create exploitable conditions that bypass traditional security controls. The complexity of media format parsing and decoding makes such vulnerabilities particularly challenging to detect and prevent, requiring comprehensive testing strategies that include fuzzing and symbolic execution to identify similar conditions in related codecs and libraries.