Bug 2516073

Summary: CVE-2026-70630 ffmpeg: FFmpeg: Information disclosure via uninitialized heap memory read in Screenpresso decoder [fedora-43]
Product: [Fedora] Fedora Reporter: Joel Chamberlain <jochambe>
Component: ffmpegAssignee: Multimedia SIG <multimedia-sig>
Status: ASSIGNED --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 43CC: asn, development.group, dominik, multimedia-sig, ngompa13
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["99beb3fa-1612-4be3-8104-bcabf3a1d025"]}
Fixed In Version: ffmpeg-9.0.1-1.fc46,ffmpeg-9.0.1-4.fc45,ffmpeg-8.1.3-1.fc44 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2512259    

Description Joel Chamberlain 2026-08-14 16:08:25 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services.
Comment 1 Dominik 'Rathann' Mierzejewski 2026-09-29 08:58:49 UTC 
Fixed in:
9.0:   https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62
8.1.3: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6b4c648d0e1ddbcca3d1ef62b902e6f07ca9a170

NOT fixed in 7.1.x.
Comment 2 Fedora Update System 2026-09-29 08:59:33 UTC 
FEDORA-2026-3e109a0c85 (ffmpeg-8.1.3-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e109a0c85