CVE-2026-70632 FFmpeg CVE debrief

Who should care

Users and administrators of FFmpeg installations, particularly those using versions from 4.4 up to, but not including, 9.0, should be aware of this vulnerability and take defensive actions to mitigate potential exploitation attempts.

Technical summary

The cfhd_decode() function in FFmpeg versions from 4.4 up to, but not including, 9.0 fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.

Defensive priority

High-priority defensive actions are required to address the out-of-bounds heap write vulnerability in FFmpeg versions from 4.4 up to, but not including, 9.0.

Recommended defensive actions

• Inventory FFmpeg installations and verify versions are within the affected range.
• Apply patches or updates from the FFmpeg project to address the vulnerability.
• Implement compensating controls, such as monitoring and exception tracking, to detect potential exploitation attempts.
• Restrict access to AVI files and limit the use of the CFHD decoder.
• Consider using alternative decoders or media processing tools.

Evidence notes

The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer. Evidence is based on official CVE Program record and NVD vulnerability detail.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.