CVE-2026-70632

HIGH

FFmpeg 4.4 < 9.0 Heap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-70632 has a selected CVSS score of 8.5 (high); EIP currently links 1 curated repository PoC and 2 lab environments.

Description

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
1
Lab environments
2

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 7, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

FFmpeg

Browse FFmpeg / FFmpeg

Default status: unaffected

CVE List4.4 to < 9.0affected

Proofs of concept

1

Curated repository PoCs

GitHubCVE-2026-70632Curated repository PoCby exploitintel8Exploit10 files

C · 34.1 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script (poc/poc.py) that generates a crafted AVI file and executes it against a vulnerable FFmpeg build to trigger a heap out-of-bounds write in the CFHD decoder. The script constructs a malicious CFHD bitstream with an oversized band width, writes it to an AVI file, and then runs FFmpeg via Docker to probe the file, confirming the crash via AddressSanitizer output. This constitutes an exploit as it exercises the vulnerability to cause a deterministic heap buffer overflow.

Backdoor review

No backdoor observed in reviewed code

The PoC generates a crafted AVI file to trigger a documented heap out-of-bounds write in FFmpeg's CFHD decoder. The Python script (poc/poc.py) constructs the malicious bitstream and optionally runs it against a Dockerized vulnerable FFmpeg build to observe an AddressSanitizer crash. No concealed executable behavior, persistence, credential theft, or unrelated payload delivery is present. The code performs only the described vulnerability demonstration.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareFFmpeg
Attack typesHeap Out-of-Bounds Write
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively generates a malicious input and executes it against a vulnerable target to trigger a heap out-of-bounds write, which is the definition of an exploit. It does not merely scan for the vulnerability or describe it; it exercises the flaw to cause a crash.

poc/poc.py:18-28poc/poc.py:204-214poc/poc.py:217-258

Requirements

  • Docker with compose must be installed to build and run the vulnerable FFmpeg lab environment.README.md:111
  • The vulnerable FFmpeg Docker image must be built using 'docker compose build' before running the exploit.README.md:116

Observed behavior

  • Generates a minimal AVI file containing a crafted CFHD bitstream with an oversized band[4][1] width (288) for a 64x64 coded frame.poc/poc.py:118-166poc/poc.py:204-214
  • Executes the vulnerable FFmpeg build inside a Docker container to probe the generated AVI file, triggering the heap buffer overflow.poc/poc.py:217-258
  • Validates the exploit by checking for AddressSanitizer 'heap-buffer-overflow' signature in 'horiz_filter_clip' from 'cfhd_decode'.poc/poc.py:247-253
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Execution
Payload withheldThe PoC optionally executes a Docker container running a vulnerable FFmpeg build to validate the crash. This is the intended exploit demonstration and is not concealed or harmful beyond the stated purpose.poc/poc.py:222-228
File Write
Payload withheldThe script writes a crafted AVI file containing the malicious CFHD bitstream. This is the PoC payload, not a backdoor.poc/poc.py:209-210
Review boundaries

What the analysis did not establish

  • The evidence does not include the Dockerfiles or lab environment files referenced by the PoC, so the exact build configuration and dependencies cannot be verified.
  • The PoC only demonstrates a crash (DoS) and does not include the code execution escalation mentioned in the advisory.
  • The analysis is based solely on the provided text files; the binary AVI output and Docker execution are not included in the evidence.
  • Docker images and binary artifacts (e.g., the vulnerable FFmpeg build) are not included in the supplied text evidence; only the Python PoC script and documentation were reviewed.
  • The verification report references external artifact files (poc_run.txt, crash-session.txt, etc.) that are not part of the supplied evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

2
GitHub

CVE-2026-70632/docker-compose.control.yml

CVE-2026-70632Created Vuln labCVE-2026-70632Compose · mixed

1 Compose manifest · 1 Dockerfile · 1 service

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds a patched FFmpeg n9.0 image with AddressSanitizer, configured as a control target for verifying that CVE-2026-70632 is fixed. The service mounts a local poc/ directory read-only for supplying a crafted AVI file.

CVE-2026-70632/docker-compose.control.yml:1-10CVE-2026-70632/Dockerfile.patched:1-29

Lab assessment

Vulnerability lab

The environment is explicitly a control lab for CVE-2026-70632. The README and PoC script describe it as the patched n9.0 control environment used to confirm the vulnerability is fixed. The Dockerfile builds FFmpeg n9.0 with ASan and the compose file mounts the PoC directory for testing.

CVE-2026-70632/README.md:1-146CVE-2026-70632/poc/poc.py:1-314CVE-2026-70632/docker-compose.control.yml:1-10
Lab shapeCompose · mixed
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

target

patched FFmpeg n9.0 control buildvulnerability verification target

A Docker service built from Dockerfile.patched using the n9.0 tag of FFmpeg. It compiles a minimal ASan-instrumented ffmpeg binary with only the AVI demuxer and CFHD decoder enabled. The service mounts the local poc/ directory read-only at /work/poc and runs /bin/bash by default, allowing the PoC script to execute ffmpeg against a crafted AVI to verify the patch.

CVE-2026-70632/docker-compose.control.yml:1-10CVE-2026-70632/Dockerfile.patched:1-29
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-70632

Supported by supplied evidence

The entire unit is dedicated to demonstrating CVE-2026-70632. The README, PoC script, and verification report all describe the vulnerability, its root cause, and the control environment for confirming the fix. The Dockerfile builds the patched version (n9.0) that contains the fix, and the PoC script includes a --control mode to validate the patch.

CVE-2026-70632/README.md:1-146CVE-2026-70632/poc/poc.py:1-314CVE-2026-70632/poc_verification_report.md:1-57
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker with Compose installed on the host.CVE-2026-70632/README.md:100-101
  • Python 3 with standard library only to run poc/poc.py.CVE-2026-70632/README.md:108
  • The control Docker image must be built before running the PoC in control mode.CVE-2026-70632/README.md:104-105

Evidence-described exercise path

  1. Build the control Docker image: docker compose -p cve-2026-70632-control -f docker-compose.control.yml buildCVE-2026-70632/README.md:104
  2. Run the PoC in control mode: python3 poc/poc.py --controlCVE-2026-70632/README.md:105
  3. The PoC script generates a crafted AVI, copies it into the mounted poc/ directory, and executes ffmpeg inside the control container. The expected result is a clean rejection with 'Invalid plane dimensions' and no crash.CVE-2026-70632/poc/poc.py:200-250CVE-2026-70632/poc_verification_report.md:30-33
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained control lab for verifying a vulnerability fix. The Dockerfile builds FFmpeg from a public repository with no hidden payloads. The compose file mounts only the local poc/ directory read-only, uses no host ports, and does not run in privileged mode. The PoC script executes ffmpeg inside the container against a user-supplied AVI; all behavior is directed at the lab target and necessary for the exercise. No host escape, persistence, credential theft, or external communication is observed.

CVE-2026-70632/docker-compose.control.yml:1-10CVE-2026-70632/Dockerfile.patched:1-29CVE-2026-70632/poc/poc.py:200-250
Review boundaries

What the analysis did not establish

  • Only the control (patched) compose file and Dockerfile are included in evidence; the vulnerable lab compose file and Dockerfile are referenced in the file inventory but not provided as evidence text.
  • The PoC script's validate function invokes docker compose run, which requires Docker access on the host; this is expected for a lab but could be abused if the script were malicious. The script's behavior is fully visible and limited to running ffmpeg inside the container.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

CVE-2026-70632/docker-compose.yml

CVE-2026-70632Created Vuln labCVE-2026-70632Compose · mixed

1 Compose manifest · 1 Dockerfile · 1 service

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds a vulnerable FFmpeg n8.1.2 with AddressSanitizer, mounts a PoC directory, and provides a CLI target for reproducing CVE-2026-70632.

CVE-2026-70632/docker-compose.yml:1-10CVE-2026-70632/Dockerfile.vulnerable:1-29

Lab assessment

Vulnerability lab

The environment is explicitly designed to reproduce CVE-2026-70632, a heap out-of-bounds write in FFmpeg's CFHD decoder. The Dockerfile builds a vulnerable FFmpeg version with ASan, the compose file mounts a PoC directory, and the README and PoC script describe the vulnerability and exercise steps.

CVE-2026-70632/README.md:1-10CVE-2026-70632/poc/poc.py:1-20CVE-2026-70632/docker-compose.yml:1-10
Lab shapeCompose · mixed
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

target

vulnerable FFmpeg buildexploit target

A Docker service built from Dockerfile.vulnerable, which compiles FFmpeg n8.1.2 with ASan and a minimal configuration (AVI demuxer, CFHD decoder). It mounts the local ./poc directory read-only at /work/poc and runs /bin/bash as the default command.

CVE-2026-70632/docker-compose.yml:2-9CVE-2026-70632/Dockerfile.vulnerable:1-29

poc.py

PoC generatorlab runner

A Python script that generates a malicious AVI file to trigger the heap overflow in the CFHD decoder, then optionally runs the Docker lab to validate the crash against the vulnerable build or a patched control build.

CVE-2026-70632/poc/poc.py:1-60CVE-2026-70632/poc/poc.py:200-250
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-70632

Supported by supplied evidence

The packet provides a complete reproduction environment: a vulnerable FFmpeg build, a PoC that generates a crafted AVI, and documentation describing the root cause and fix. The PoC script and README explicitly associate the environment with CVE-2026-70632.

CVE-2026-70632/README.md:1-10CVE-2026-70632/poc/poc.py:1-20CVE-2026-70632/Dockerfile.vulnerable:1-29
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker with compose installed on the host.CVE-2026-70632/README.md:100-102
  • Python 3 with standard library only.CVE-2026-70632/README.md:110-111

Evidence-described exercise path

  1. Build the vulnerable Docker image: `docker compose build`CVE-2026-70632/README.md:104-105
  2. Run the PoC script to generate the malicious AVI and trigger the crash in the lab: `python3 poc/poc.py`CVE-2026-70632/README.md:105-106CVE-2026-70632/poc/poc.py:200-250
  3. Optionally, build the patched control image and run the PoC with `--control` to verify the fix.CVE-2026-70632/README.md:108-110
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab container. The PoC generates a file and runs ffmpeg inside the container to trigger a crash; no host escape, external connections, persistence, or credential theft is observed. The compose file uses a read-only bind mount and no privileged mode or host port mappings.

CVE-2026-70632/docker-compose.yml:1-10CVE-2026-70632/poc/poc.py:200-250
Review boundaries

What the analysis did not establish

  • The packet does not include the control Dockerfile (Dockerfile.patched) or control compose file (docker-compose.control.yml) in the evidence files, though they are referenced in the README and file inventory.
  • The PoC script references a control environment and a patched build, but the evidence for those is not supplied in the analyzed text.
  • The verification report mentions artifact files (e.g., artifacts/poc_run.txt) that are not included in the evidence packet.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

6