Description

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-06T22:18:27.123Z",
  "pubdate": "2026-08-06T22:18:27.123Z",
  "executiveSummary": "FFmpeg versions ranging from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability residing within the native RSCC decoder component. This vulnerability allows remote attackers or malicious entities to achieve information disclosure by exposing sensitive heap memory contents. The flaw is triggered when an attacker supplies a specially crafted video file containing a compressed tile designed to decompress fewer bytes than the expected tile geometry demands. Consequently, the affected system processes frames using an unvalidated byte count, leading to the inclusion of unwritten portions of persistent intermediate buffers within the final decoded output. This poses significant risk implications, particularly in persistent decoding services where prior heap allocations or data from previously processed frames may leak across security boundaries. Exploitation relies on the supply of a crafted file processed by vulnerable FFmpeg instances without requiring prior authentication or elevated privileges.",
  "technicalDetails": "The vulnerability stems from insufficient bounds checking and validation logic within the native RSCC decoder implemented in libavcodec/rscc.c, specifically inside the rscc_decode_frame() function. Affected software versions include FFmpeg 3.0 up to, but not including, 9.0. The root cause involves the handling of compressed tiles within video streams where the actual decompressed byte count does not match the dimensions declared in the tile geometry. During the decoding sequence, rscc_decode_frame() invokes av_image_copy_plane() to transfer pixel data from the intermediate buffer ctx->inflated_buf into the final decoded frame structure. Because the function fails to validate whether the decompressed byte count satisfies the full allocation required by the declared tile dimensions, an unwritten suffix of the persistent intermediate buffer remains populated with stale data from prior heap allocations or previous decoding operations. As a result, this uninitialized heap memory is copied directly into the decoded frame. The attack flow requires an attacker to construct a malformed video file containing a crafted RSCC-encoded tile and submit it to a target system or persistent decoding service utilizing vulnerable FFmpeg libraries. When the application decodes the manipulated media file, the payload behavior manifests as data leakage, exposing sensitive memory contents present in the heap. Post-exploitation impact is strictly centered around information disclosure, potentially compromising adjacent memory regions, application secrets, or data remnants from concurrent processing tasks in long-running decoding pipelines. The vulnerability can be exploited locally through file ingestion or remotely via network services that automatically process untrusted multimedia inputs without authentication or privilege requirements."
}