The vulnerability (CVE-2026-70632) exists in FFmpeg's native GoPro CineForm HD (CFHD) decoder in versions >=4.4 and <9.0. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing the horiz_filter_clip() function to write oversized 16-bit sample rows beyond the allocated output frame buffer. This out-of-bounds heap write can be triggered by a crafted AVI file during stream probing and may lead to heap corruption and potentially arbitrary code execution via overwriting a live cleanup callback pointer. Ubuntu security notices confirm the issue affects Ubuntu 22.04 LTS and 24.04 LTS and provide patched package versions.

Successful exploitation can lead to heap memory corruption and potentially arbitrary code execution with user-level privileges. The CVSS score of 7.8 reflects high confidentiality, integrity, and availability impacts, though the attack vector requires local access (AV:L) and user interaction (UI:R). No known exploits in the wild have been reported. The vulnerability affects multimedia processing on systems using vulnerable FFmpeg versions, potentially allowing attackers to execute code by processing crafted AVI files.

A fix is available. Ubuntu provides patched versions of FFmpeg and related libraries for Ubuntu 22.04 LTS and 24.04 LTS via Ubuntu Pro Extended Security Maintenance (ESM). Users should apply standard system updates or upgrade to the patched package versions listed in the Ubuntu advisory USN-8680-1. No additional mitigation steps are required beyond applying these official updates.