Heap Memory Disclosure Vulnerability in FFmpeg's TIFF Decoder

CVE-2026-70631

What is CVE-2026-70631?

An uninitialized heap memory disclosure vulnerability exists within the native TIFF decoder of FFmpeg, specifically in the libavcodec/tiff.c file. This vulnerability arises when an attacker crafts a TIFF file that leads FFmpeg to decode it, resulting in successful termination after producing fewer bytes than required. The tiff_unpack_zlib() function dynamically allocates a heap buffer for the entire declared strip but uses memcpy() to copy all declared rows, regardless of the actual bytes decompressed by zlib. This can inadvertently incorporate stale data from previous heap allocations into the decoded output, creating a risk of exposing sensitive information through persistent services.

References