CVE-2026-70631 FFmpeg 0.5 < 9.0 Uninitialized Heap Memory Read in TIFF Decoder
Attackers can expose sensitive heap memory data by crafting TIFF files that trigger uninitialized memory reads in FFmpeg's TIFF decoder.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-70631?
CVE-2026-70631 is a medium-severity vulnerability in Ffmpeg Ffmpeg, published on 6 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.
Weakness: CWE-908
Which versions are affected by CVE-2026-70631?
It affects 1 product.
Products include Ffmpeg Ffmpeg.
How do I fix CVE-2026-70631?
Upgrade to a fixed version.
Is CVE-2026-70631 being exploited?
There is no known exploitation of CVE-2026-70631 in the wild and no public exploit code.
Other vulnerabilities in Ffmpeg Ffmpeg
Sources
Also known as DEBIAN-CVE-2026-70631, ECHO-fb13-cd27-af33, GHSA-5f73-3r3j-p8mr, JLSEC-2026-1191, UBUNTU-CVE-2026-70631.