High [CVE-2026-70632] Arbitrary Code Execution in CFHD Decoder via Crafted AVI File
This high-severity Red Hat Linux advisory covers CVE-2026-70632 affecting Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI).
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing.
The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.
A flaw was found in FFmpeg. A remote attacker can exploit this by providing a specially crafted AVI (Audio Video Interleave) file during stream analysis.
This can lead to memory corruption and may be escalated to arbitrary code execution, allowing the attacker to run malicious code on the affected system. Exploitation requires a local attacker to entice a user into processing a specially crafted AVI file, which triggers an out-of-bounds write in the FFmpeg CineForm HD (CFHD) decoder.
This user interaction and local attack vector reduce the overall risk compared to remotely exploitable flaws. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Weakness: CWE-787.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
Mitigation checklist
- To mitigate this issue, users should avoid processing untrusted or suspicious AVI media files with applications that utilize the FFmpeg library. Exercise caution when handling media from unknown sources to prevent potential exploitation.
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.