CVE-2026-70630— FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in Screenpresso Decoder

FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in Screenpresso Decoder

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

对未经初始化资源的使用

FFmpeg 资源管理错误漏洞

FFmpeg是FFmpeg组织开源的一个多媒体处理框架。 FFmpeg 3.0版本至9.0之前版本存在资源管理错误漏洞，该漏洞源于原生Screenpresso解码器中的未初始化堆内存读取问题，screenpresso_decode_frame()函数在调用av_image_copy_plane()前未验证产生的字节数，导致未写入的堆内存被复制到解码输出，攻击者可通过提供特制的SPV1数据包恢复敏感内存内容。

N/A

N/A