CVE-2026-70629 FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in RSCC Decoder

What is CVE-2026-70629?

CVE-2026-70629 is a medium-severity vulnerability in Ffmpeg Ffmpeg, published on 6 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services.

Weakness: CWE-908

Which versions are affected by CVE-2026-70629?

It affects 1 product.

Products include Ffmpeg Ffmpeg.

How do I fix CVE-2026-70629?

Upgrade to a fixed version.

Is CVE-2026-70629 being exploited?

There is no known exploitation of CVE-2026-70629 in the wild and no public exploit code.

Other vulnerabilities in Ffmpeg Ffmpeg

• CVE-2013-0864 Memory corruption in n/a Critical 10.0
• CVE-2013-0872 Memory corruption in n/a Critical 10.0
• CVE-2013-0873 Memory corruption in n/a Critical 10.0
• CVE-2013-4265 Null dereference in n/a Critical 10.0
• CVE-2011-3937 Memory corruption in n/a Critical 10.0

All Ffmpeg Ffmpeg vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-70629, ECHO-6986-2e97-593f, GHSA-824f-v6qw-342h, JLSEC-2026-1189, OESA-2026-3467, OESA-2026-3471 and 1 more.