FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD)… (CVE-2026-70632)
FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.
AI Analysis
Technical Summary
An out-of-bounds heap write vulnerability exists in FFmpeg's native GoPro CineForm HD (CFHD) decoder in versions from 4.4 up to, but not including, 9.0. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing the horiz_filter_clip() function to write oversized 16-bit sample rows beyond the allocated output frame buffer. This memory corruption can be exploited by remote attackers supplying a crafted AVI file during stream probing, potentially leading to arbitrary code execution by overwriting a live cleanup callback pointer.
Potential Impact
Successful exploitation allows remote attackers to corrupt heap memory and potentially achieve arbitrary code execution. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor FFmpeg's official channels for updates addressing this vulnerability. Until a patch is available, avoid processing untrusted AVI files with vulnerable FFmpeg versions.
FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD)… (CVE-2026-70632)
Description
FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.
CVSS v3.1
Score 7.8high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
An out-of-bounds heap write vulnerability exists in FFmpeg's native GoPro CineForm HD (CFHD) decoder in versions from 4.4 up to, but not including, 9.0. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing the horiz_filter_clip() function to write oversized 16-bit sample rows beyond the allocated output frame buffer. This memory corruption can be exploited by remote attackers supplying a crafted AVI file during stream probing, potentially leading to arbitrary code execution by overwriting a live cleanup callback pointer.
Potential Impact
Successful exploitation allows remote attackers to corrupt heap memory and potentially achieve arbitrary code execution. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor FFmpeg's official channels for updates addressing this vulnerability. Until a patch is available, avoid processing untrusted AVI files with vulnerable FFmpeg versions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-q24x-99v6-6hxc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-70632"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a75739bbf8831d539d91c10
Added to database: 08/07/2026, 05:56:43 UTC
Last enriched: 08/07/2026, 07:41:06 UTC
Last updated: 08/08/2026, 00:41:15 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.