CVE-2026-70631

Name of the Vulnerable Software and Affected Versions FFmpeg versions 0.5 through 8.x

Description An uninitialized heap memory disclosure exists in the native TIFF decoder within libavcodec/tiff.c. An attacker can exploit this by providing a crafted TIFF file containing a valid Deflate-compressed strip that produces fewer bytes than declared. The tiff unpack zlib() function allocates a heap buffer for the full declared strip but uses memcpy() to copy all declared rows regardless of the actual bytes decompressed by zlib. This process incorporates unwritten bytes containing stale data from previous heap allocations into the decoded image output, which may expose sensitive information in persistent services.

Recommendations Update FFmpeg to version 9.0 or later.