Vulnerability · Published Aug 6, 2026 · Assigned by VulnCheck

CVE-2026-70629FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in RSCC Decoder

Medium 5.5

In plain English

A medium-severity security flaw in FFmpeg from FFmpeg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.2%top 93.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ffmpeg	no fix listed	DEBIAN-CVE-2026-70629
Debian:13	ffmpeg	no fix listed	DEBIAN-CVE-2026-70629
Debian:14	ffmpeg	7:9.0.2-1	DEBIAN-CVE-2026-70629
Ubuntu:26.10	ffmpeg	no fix listed	UBUNTU-CVE-2026-70629

Affected products (as reported)

Vendor	Product	Versions
FFmpeg	FFmpeg	3.0 – before 9.0

Weakness: CWE-908 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

Pull Request issue-tracking
Introducing Commit related
Patch Commit patch
FFmpeg 9.0 Backport Commit patch
https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder third-party-advisory