Uninitialized Heap Memory Read Vulnerability in FFmpeg Product by VideoLAN

CVE-2026-70630

What is CVE-2026-70630?

FFmpeg versions ranging from 3.0 through to 8.999 exhibit a serious vulnerability in the Screenpresso decoder located in the libavcodec module. This vulnerability arises from an uninitialized heap memory read that allows attackers to exploit a crafted SPV1 packet, which utilizes a valid zlib stream that decompresses fewer bytes than a complete frame demands. A flaw in the screenpresso_decode_frame() function's validation process leads to the use of unwritten heap memory from prior allocations, subsequently resulting in the exposure of sensitive data, such as userspace addresses. This poses a significant security risk for environments relying on FFmpeg for media decoding and processing.

References