Description

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-06T22:18:27.567Z",
  "pubdate": "2026-08-06T22:18:27.567Z",
  "executiveSummary": "An out-of-bounds heap write vulnerability exists in the native GoPro CineForm HD (CFHD) decoder of FFmpeg, specifically within the stream probing functionality. The flaw allows a remote attacker to achieve heap memory corruption by supplying a maliciously crafted AVI file. Successful exploitation requires no authentication or special privileges, as the vulnerability is triggered automatically during file parsing and stream probing operations. The core issue stems from an unvalidated logical output-width invariant in the transform-type-2 reconstruction path, leading to out-of-bounds memory writes during pixel filtering. The ultimate impact of this vulnerability includes denial of service and potential escalation to arbitrary code execution through the controlled overwrite of live cleanup callback pointers in adjacent heap memory. Affected systems include all FFmpeg deployments utilizing vulnerable versions ranging from 4.4 up to, but not including, 9.0. Due to the nature of media processing libraries handling untrusted user input, this vulnerability poses a severe risk to applications embedding FFmpeg for media ingestion, transcoding, or analysis.",
  "technicalDetails": "The vulnerability resides within the native GoPro CineForm HD (CFHD) decoder implemented in FFmpeg, specifically inside the cfhd_decode() function located in the CFHD decoding component. The root cause of the vulnerability is the failure of the decoding logic to enforce the non-Bayer logical output-width invariant within the transform-type-2 reconstruction path.\nDuring the processing of a crafted AVI file containing CFHD streams, the decoding engine processes transform-type-2 data structures. Because the implementation lacks proper validation of the logical output-width against the allocated frame buffer dimensions, subsequent filtering operations fail to constrain write boundaries. Specifically, the horiz_filter_clip() function is invoked to process and write 16-bit sample rows.\nWithout adequate bounds checking or width enforcement, horiz_filter_clip() writes oversized 16-bit sample rows far beyond the boundaries of the pre-allocated output frame buffer, resulting in a heap-based out-of-bounds write.\nThe attack flow proceeds as follows: 1) A remote attacker crafts a malicious AVI file containing manipulated CFHD stream headers and transform-type-2 data. 2) The victim application utilizes FFmpeg to probe or decode the stream. 3) The parsing engine invokes cfhd_decode() during the stream probing phase. 4) The decoder processes the transform-type-2 reconstruction path, bypassing output-width checks. 5) The horiz_filter_clip() function executes and writes 16-bit sample data past the end of the heap-allocated frame buffer. 6) The heap memory corruption overwrites adjacent critical data structures, such as live cleanup callback pointers.\nThe attacker can manipulate the layout of the heap to reliably corrupt function pointers or control data, leading to the redirection of execution flow and arbitrary code execution under the security context of the process running FFmpeg. The vulnerability requires network exposure only in scenarios where media processing pipelines ingest remote streams, but applies universally wherever untrusted AVI files are processed by vulnerable FFmpeg instances."
}