CVE-2026-70630

Name of the Vulnerable Software and Affected Versions FFmpeg versions 3.0 through 8.x

Description An uninitialized heap memory read exists in the native Screenpresso decoder (libavcodec/screenpresso.c). An attacker can recover sensitive memory contents, such as userspace addresses from persistent decoding services, by providing a crafted SPV1 packet containing a valid zlib stream that decompresses fewer bytes than the full frame requires. This occurs because the screenpresso decode frame() function does not validate the produced byte count before calling av image copy plane() to copy the frame dimensions from the ctx->inflated buf buffer, resulting in unwritten heap memory from previous allocations or frames being copied into the decoded output.

Recommendations Update to version 9.0 or later. As a temporary mitigation, restrict the use of the Screenpresso decoder in libavcodec/screenpresso.c.