CVE-2026-70632: Ffmpeg

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.

Affected products

• Ffmpeg Ffmpeg: from 4.4, before 9 (fixed in 9)

Published 2026-08-06. Last modified 2026-09-01.