# CVE-2026-70632: ffmpeg: FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the nativ...

CVE-2026-70632 is fixed in 38 products on 1 platform, first by ffmpeg 7:8.0.1-3ubuntu2+esm3, released August 6, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-70632
- Priority: Routine
- CVSS: n/a (Medium)
- EPSS: 0.0023
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 6, 2026

## Description

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | ffmpeg Debian 14 | 7:9.0.2-1 | [DEBIAN-CVE-2026-70632](https://patchblox.com/security/data/fix/linux/debian-cve-2026-70632.md) | Aug 6, 2026 |
| Linux | ffmpeg Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm14 | [ffmpeg 7:4.4.2-0ubuntu0.22.04.1+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-ffmpeg-7-4.4.2-0ubuntu0.22.04.1-esm14.md) | Aug 27, 2026 |
| Linux | ffmpeg Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm12 | [ffmpeg 7:6.1.1-3ubuntu5+esm12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ffmpeg-7-6.1.1-3ubuntu5-esm12.md) | Aug 27, 2026 |
| Linux | ffmpeg Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm3 | [ffmpeg 7:8.0.1-3ubuntu2+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-ffmpeg-7-8.0.1-3ubuntu2-esm3.md) | Aug 6, 2026 |
| Linux | ffmpeg-4 sles 15.7 | 4.4.8-150600.13.55.1 | [SUSE-SU-2026:4149-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4149-1.md) | Sep 14, 2026 |
| Linux | ffmpeg-7 opensuse-leap 16.0 | 7.1.5-160000.1.1 | [OPENSUSE-SU-2026:21877-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21877-1.md) | Sep 18, 2026 |
| Linux | libavcodec-extra Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm14 | [libavcodec-extra 7:4.4.2-0ubuntu0.22.04.1+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libavcodec-extra-7-4.4.2-0ubuntu0.22.04.1-esm14.md) | Aug 27, 2026 |
| Linux | libavcodec-extra Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm12 | [libavcodec-extra 7:6.1.1-3ubuntu5+esm12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libavcodec-extra-7-6.1.1-3ubuntu5-esm12.md) | Aug 27, 2026 |
| Linux | libavcodec-extra Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm3 | [libavcodec-extra 7:8.0.1-3ubuntu2+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libavcodec-extra-7-8.0.1-3ubuntu2-esm3.md) | Aug 6, 2026 |
| Linux | libavcodec-extra58 Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm14 | [libavcodec-extra58 7:4.4.2-0ubuntu0.22.04.1+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libavcodec-extra58-7-4.4.2-0ubuntu0.22.04.1-esm14.md) | Aug 27, 2026 |
| Linux | libavcodec-extra60 Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm12 | [libavcodec-extra60 7:6.1.1-3ubuntu5+esm12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libavcodec-extra60-7-6.1.1-3ubuntu5-esm12.md) | Aug 27, 2026 |
| Linux | libavcodec-extra62 Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm3 | [libavcodec-extra62 7:8.0.1-3ubuntu2+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libavcodec-extra62-7-8.0.1-3ubuntu2-esm3.md) | Aug 6, 2026 |
| Linux | libavcodec58 Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm14 | [libavcodec58 7:4.4.2-0ubuntu0.22.04.1+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libavcodec58-7-4.4.2-0ubuntu0.22.04.1-esm14.md) | Aug 27, 2026 |
| Linux | libavcodec60 Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm12 | [libavcodec60 7:6.1.1-3ubuntu5+esm12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libavcodec60-7-6.1.1-3ubuntu5-esm12.md) | Aug 27, 2026 |
| Linux | libavcodec62 Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm3 | [libavcodec62 7:8.0.1-3ubuntu2+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libavcodec62-7-8.0.1-3ubuntu2-esm3.md) | Aug 6, 2026 |
| Linux | libavdevice58 Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm14 | [libavdevice58 7:4.4.2-0ubuntu0.22.04.1+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libavdevice58-7-4.4.2-0ubuntu0.22.04.1-esm14.md) | Aug 27, 2026 |
| Linux | libavdevice60 Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm12 | [libavdevice60 7:6.1.1-3ubuntu5+esm12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libavdevice60-7-6.1.1-3ubuntu5-esm12.md) | Aug 27, 2026 |
| Linux | libavdevice62 Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm3 | [libavdevice62 7:8.0.1-3ubuntu2+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libavdevice62-7-8.0.1-3ubuntu2-esm3.md) | Aug 6, 2026 |
| Linux | libavfilter-extra Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm14 | [libavfilter-extra 7:4.4.2-0ubuntu0.22.04.1+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libavfilter-extra-7-4.4.2-0ubuntu0.22.04.1-esm14.md) | Aug 27, 2026 |
| Linux | libavfilter-extra Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm12 | [libavfilter-extra 7:6.1.1-3ubuntu5+esm12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libavfilter-extra-7-6.1.1-3ubuntu5-esm12.md) | Aug 27, 2026 |
| Linux | libavfilter-extra Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm3 | [libavfilter-extra 7:8.0.1-3ubuntu2+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libavfilter-extra-7-8.0.1-3ubuntu2-esm3.md) | Aug 6, 2026 |
| Linux | libavfilter-extra11 Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm3 | [libavfilter-extra11 7:8.0.1-3ubuntu2+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libavfilter-extra11-7-8.0.1-3ubuntu2-esm3.md) | Aug 6, 2026 |
| Linux | libavfilter-extra7 Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm14 | [libavfilter-extra7 7:4.4.2-0ubuntu0.22.04.1+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libavfilter-extra7-7-4.4.2-0ubuntu0.22.04.1-esm14.md) | Aug 27, 2026 |
| Linux | libavfilter-extra9 Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm12 | [libavfilter-extra9 7:6.1.1-3ubuntu5+esm12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libavfilter-extra9-7-6.1.1-3ubuntu5-esm12.md) | Aug 27, 2026 |
| Linux | libavfilter11 Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm3 | [libavfilter11 7:8.0.1-3ubuntu2+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libavfilter11-7-8.0.1-3ubuntu2-esm3.md) | Aug 6, 2026 |
| Linux | libavfilter7 Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm14 | [libavfilter7 7:4.4.2-0ubuntu0.22.04.1+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libavfilter7-7-4.4.2-0ubuntu0.22.04.1-esm14.md) | Aug 27, 2026 |
| Linux | libavfilter9 Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm12 | [libavfilter9 7:6.1.1-3ubuntu5+esm12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libavfilter9-7-6.1.1-3ubuntu5-esm12.md) | Aug 27, 2026 |
| Linux | libavformat-extra Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm14 | [libavformat-extra 7:4.4.2-0ubuntu0.22.04.1+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libavformat-extra-7-4.4.2-0ubuntu0.22.04.1-esm14.md) | Aug 27, 2026 |
| Linux | libavformat-extra Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm12 | [libavformat-extra 7:6.1.1-3ubuntu5+esm12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libavformat-extra-7-6.1.1-3ubuntu5-esm12.md) | Aug 27, 2026 |
| Linux | libavformat-extra Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm3 | [libavformat-extra 7:8.0.1-3ubuntu2+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libavformat-extra-7-8.0.1-3ubuntu2-esm3.md) | Aug 6, 2026 |
| Linux | libavformat-extra58 Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm14 | [libavformat-extra58 7:4.4.2-0ubuntu0.22.04.1+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libavformat-extra58-7-4.4.2-0ubuntu0.22.04.1-esm14.md) | Aug 27, 2026 |
| Linux | libavformat-extra60 Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm12 | [libavformat-extra60 7:6.1.1-3ubuntu5+esm12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libavformat-extra60-7-6.1.1-3ubuntu5-esm12.md) | Aug 27, 2026 |
| Linux | libavformat-extra62 Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm3 | [libavformat-extra62 7:8.0.1-3ubuntu2+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libavformat-extra62-7-8.0.1-3ubuntu2-esm3.md) | Aug 6, 2026 |
| Linux | libavformat58 Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm14 | [libavformat58 7:4.4.2-0ubuntu0.22.04.1+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libavformat58-7-4.4.2-0ubuntu0.22.04.1-esm14.md) | Aug 27, 2026 |
| Linux | libavformat60 Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm12 | [libavformat60 7:6.1.1-3ubuntu5+esm12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libavformat60-7-6.1.1-3ubuntu5-esm12.md) | Aug 27, 2026 |
| Linux | libavformat62 Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm3 | [libavformat62 7:8.0.1-3ubuntu2+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libavformat62-7-8.0.1-3ubuntu2-esm3.md) | Aug 6, 2026 |
| Linux | libavutil56 Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm14 | [libavutil56 7:4.4.2-0ubuntu0.22.04.1+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libavutil56-7-4.4.2-0ubuntu0.22.04.1-esm14.md) | Aug 27, 2026 |
| Linux | libavutil58 Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm12 | [libavutil58 7:6.1.1-3ubuntu5+esm12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libavutil58-7-6.1.1-3ubuntu5-esm12.md) | Aug 27, 2026 |
| Linux | libavutil60 Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm3 | [libavutil60 7:8.0.1-3ubuntu2+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libavutil60-7-8.0.1-3ubuntu2-esm3.md) | Aug 6, 2026 |
| Linux | libpostproc55 Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm14 | [libpostproc55 7:4.4.2-0ubuntu0.22.04.1+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libpostproc55-7-4.4.2-0ubuntu0.22.04.1-esm14.md) | Aug 27, 2026 |
| Linux | libpostproc57 Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm12 | [libpostproc57 7:6.1.1-3ubuntu5+esm12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libpostproc57-7-6.1.1-3ubuntu5-esm12.md) | Aug 27, 2026 |
| Linux | libswresample3 Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm14 | [libswresample3 7:4.4.2-0ubuntu0.22.04.1+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libswresample3-7-4.4.2-0ubuntu0.22.04.1-esm14.md) | Aug 27, 2026 |
| Linux | libswresample4 Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm12 | [libswresample4 7:6.1.1-3ubuntu5+esm12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libswresample4-7-6.1.1-3ubuntu5-esm12.md) | Aug 27, 2026 |
| Linux | libswresample6 Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm3 | [libswresample6 7:8.0.1-3ubuntu2+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libswresample6-7-8.0.1-3ubuntu2-esm3.md) | Aug 6, 2026 |
| Linux | libswscale5 Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm14 | [libswscale5 7:4.4.2-0ubuntu0.22.04.1+esm14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libswscale5-7-4.4.2-0ubuntu0.22.04.1-esm14.md) | Aug 27, 2026 |
| Linux | libswscale7 Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm12 | [libswscale7 7:6.1.1-3ubuntu5+esm12](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libswscale7-7-6.1.1-3ubuntu5-esm12.md) | Aug 27, 2026 |
| Linux | libswscale9 Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm3 | [libswscale9 7:8.0.1-3ubuntu2+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libswscale9-7-8.0.1-3ubuntu2-esm3.md) | Aug 6, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.