Description

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-06T22:18:27.420Z",
  "pubdate": "2026-08-06T22:18:27.420Z",
  "executiveSummary": "An uninitialized heap memory disclosure vulnerability exists in the native TIFF decoder of FFmpeg libavcodec/tiff.c, affecting versions from 0.5 up to, but not including, 9.0.\nThe vulnerability arises from improper handling of Deflate-compressed strips within the tiff_unpack_zlib() function, where a discrepancy between declared strip sizes and actual zlib-decompressed byte counts leads to the inclusion of unwritten, stale heap bytes in the decoded image output.\nThis vulnerability leads to sensitive data exposure and information disclosure risks, potentially leaking prior heap allocations through persistent services that process untrusted image data.\nAn external attacker capable of supplying a crafted TIFF file to an application utilizing FFmpeg can trigger this parsing flaw without requiring authentication or specific privileges, depending on the network exposure of the image processing service.",
  "technicalDetails": "The vulnerability resides in the native TIFF decoder implemented in libavcodec/tiff.c within FFmpeg versions 0.5 through 8.x, specifically affecting the tiff_unpack_zlib() function.\nThe root cause of the issue is an unsafe memory handling pattern during the processing of compressed image data. When processing a valid Deflate-compressed strip, an attacker can supply a stream that terminates successfully after producing fewer bytes than the declared strip size requires.\nThe tiff_unpack_zlib() function allocates a destination heap buffer sized according to the full declared strip dimensions. However, it subsequently copies all declared rows via memcpy() regardless of the actual number of bytes that zlib successfully decompressed.\nThis execution flow leaves a tail of unwritten bytes in the allocated heap buffer, which still contain stale data from prior heap allocations made by the application.\nThe step-by-step attack flow involves the attacker crafting a malicious TIFF file containing a truncated Deflate-compressed strip. The attacker then delivers this file to a target system running a vulnerable version of FFmpeg via an accessible network protocol or local service.\nWhen the affected application attempts to decode the crafted TIFF file, libavcodec parses the image headers, invokes tiff_unpack_zlib(), and allocates the oversized heap buffer. As zlib decompresses fewer bytes than expected, the residual uninitialized memory remains intact within the buffer.\nThe decoding routine proceeds to incorporate these unwritten bytes into the final decoded image output structure via memcpy().\nPost-exploitation impact includes the potential exposure of sensitive data originating from prior heap allocations, which can be extracted by the attacker if the decoded image output is returned to the user or stored in a persistent service accessible to unauthorized parties.\nThe vulnerability requires no authentication or special privileges, operating purely through the ingestion of malformed input data by the vulnerable decoder component."
}