Loading story…
A high-severity vulnerability, CVE-2026-70632, was disclosed in FFmpeg affecting versions 4.4 through before 9.0. The flaw is a heap out-of-bounds write in the native GoPro CineForm HD (CFHD) decoder that can be triggered when FFmpeg probes a crafted AVI file. The bug occurs in cfhd_decode() because the transform-type-2 reconstruction path does not properly enforce output-width limits for non-Bayer data, allowing horiz_filter_clip() to write past the allocated frame buffer.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A new CVE, CVE-2026-70632, was received by disclosure@vulncheck.com for an out-of-bounds heap write in FFmpeg's CFHD decoder affecting versions 4.4 through before 9.0. The flaw can be triggered by a crafted AVI file during stream probing and may lead to heap corruption and possible arbitrary code execution.
FFmpeg pull request 23898 was opened for the change titled "avcodec/cfhd: reject transform-2 output wider than the plane." The CVE record cites this pull request as a tracking artifact related to the vulnerability fix.
FFmpeg published commits 16b2049d4d5222db6cd7c031409058571c94f6a9 and db05df9d135fb56a4babb836d5e9f5c1d984e087 to reject transform-2 output wider than the plane in the CFHD decoder. These commits are referenced as remediation-related artifacts for CVE-2026-70632.
FFmpeg introduced 3D transform support in its CFHD decoder in commit 1006a2151236f9235bf02822f263b3fb0532111e. This earlier code change is referenced by the later CVE record for CVE-2026-70632.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecode.ffmpeg.org
Open sourcecode.ffmpeg.org
Open sourcecode.ffmpeg.org
Open sourcecode.ffmpeg.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FFmpeg through version **8.1.2** is affected by **`CVE-2026-66039`**, a high-severity flaw in the **MACE6 audio decoder** that can be triggered with a crafted **CAF** file. The vulnerability stems from a signed integer overflow in `mace_decode_frame()` when attacker-controlled `bytes_per_packet` and `frames_per_packet` values are parsed from the file's `desc` chunk, causing the decoder to miscalculate output sample counts. The overflow can lead to an undersized heap allocation followed by a **heap out-of-bounds write**, creating a path to memory corruption and possible code execution in contexts where a user opens or processes a malicious media file. The issue is mapped to **`CWE-190`** and **`CWE-122`**, carries a **CVSS v3.1** rating of `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, and was fixed in FFmpeg commit `aafb5c655edc76a753275c383ebb139feb032718`, which rejects sample counts that overflow `int`.
Jul 25, 2026
A high-severity vulnerability tracked as **CVE-2026-58049** affects FFmpeg’s RASC video decoder in `libavcodec/rasc.c`, where the `decode_dlta()` function performs 32-bit reads and writes before enforcing a row-boundary check. The flaw is compounded by validating the DLTA region in pixel units rather than byte units, allowing a crafted media stream using the RASC FourCC to access several bytes past a PAL8 frame row allocation. Security advisories say the bug can trigger a bitstream-controlled heap out-of-bounds write and an adjacent out-of-bounds read during decoding, leading to memory corruption and potential remote exploitation. A public proof of concept demonstrates the issue on FFmpeg upstream code and shows how DLTA run handlers can write past a 64-byte PAL8 frame row boundary. The PoC uses a custom buffer callback to place a function pointer next to the frame buffer, then overwrites the low bytes of that pointer through a crafted DLTA run to redirect execution, while AddressSanitizer reports a heap-buffer-overflow in `decode_dlta()`. Reported mitigations include updating FFmpeg, applying vendor patches, and moving row-boundary validation ahead of every 32-bit access with stricter checks such as ensuring `cx + 4 <= w * s->bpp`.
Jul 12, 2026
FFmpeg patched **CVE-2026-8461**, a high-severity heap out-of-bounds write flaw dubbed **PixelSmash** in the `libavcodec` **MagicYUV** decoder. The bug is triggered by an odd `slice_height` condition while parsing malicious **AVI**, **MKV**, or **MOV** files and affects FFmpeg versions before **8.1.2**. The vulnerability can cause denial of service and, in some environments, lead to remote code execution. JFrog reported that applications embedding FFmpeg are exposed through their media-processing pipelines, and demonstrated full remote code execution against **Jellyfin 10.11.9** via its automated media library scan workflow, although successful RCE required **ASLR** to be disabled or bypassed. **Nextcloud** was also identified as potentially vulnerable under additional conditions, while **Plex** appears largely protected by a restricted custom FFmpeg build. Organizations using FFmpeg directly or through downstream products have been urged to upgrade to **FFmpeg 8.1.2 or later** and apply vendor patches because the decoder’s broad adoption creates a notable supply-chain exposure.
Jul 30, 2026