CVE-2026-70632 FFmpeg 4.4 < 9.0 Heap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD CFHD decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhddecode function fails to enforce...

vlc:vlc-demux-dec-libfuzzer-avi: Heap-buffer-overflow in hevc_hvcC_to_AnnexB_NAL

Project: https://github.com/videolan/vlc.git Detailed Report: https://oss-fuzz.com/testcase?key=4577381637750784 Project: vlc Fuzzing Engine: libFuzzer Fuzz Target: vlc-demux-dec-libfuzzer-avi Job Type: libfuzzerasanvlc Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address:...