The vulnerability (CVE-2026-70630) exists in FFmpeg's native Screenpresso decoder (libavcodec/screenpresso.c) in versions >=3.0 and <9.0. An attacker can supply a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function does not verify the decompressed byte count before calling av_image_copy_plane(), which copies the full frame dimensions from a persistent buffer. This leads to copying uninitialized heap memory from prior allocations or frames into the decoded output, potentially exposing sensitive memory contents such as userspace addresses from persistent decoding services.

This vulnerability can lead to information disclosure by exposing uninitialized heap memory contents, including potentially sensitive data like userspace addresses. It does not affect integrity or availability. The CVSS score is 5.5 (medium severity), reflecting local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted SPV1 packets with the Screenpresso decoder or disable this decoder if possible.