Uninitialized Heap Memory Read in FFmpeg's RSCC Decoder

CVE-2026-70629

What is CVE-2026-70629?

The FFmpeg software contains a vulnerability in the native RSCC decoder where an uninitialized heap memory read can occur. This vulnerability is triggered when a crafted video file is processed, which allows an attacker to potentially disclose contents of the heap memory. The issue arises when the function rscc_decode_frame() calls av_image_copy_plane() without proper validation of the decompressed byte count. This oversight can lead to the exposure of sensitive data from previously allocated heap memory, as the unwritten portion of a persistent buffer could inadvertently be included in the decoded output.

References