Medium [CVE-2026-70629] Information disclosure via uninitialized heap memory read in RSCC decoder
This medium-severity Red Hat Linux advisory covers CVE-2026-70629 affecting Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI).
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires.
When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services.
A flaw was found in FFmpeg. When decoding a crafted video file containing a truncated compressed tile, rscc_decode_frame() fails to validate the decompressed byte count before invoking av_image_copy_plane().
When FFmpeg runs in persistent or shared-process services, processing untrusted media can expose sensitive heap memory contents, posing a High impact to confidentiality. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).
Weakness: CWE-908. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
Red Hat does not currently list a fixing RHSA for this CVE.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 3 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 3 hours ago·verify at source
Mitigation checklist
- Avoid processing untrusted RSCC-encoded video files using FFmpeg in persistent or multi-tenant services. If decoding untrusted media is required, execute FFmpeg inside an ephemeral container or isolated systemd sandbox to prevent sensitive cross-session heap data exposure.
Official advisory · high-confidence parse· fetched 3 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.