CVE-2026-70631
Published: August 6th, 2026
FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.
MEDIUM
CVSS v3: 5.5
CVSS v3: 5.5
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| 26.3 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 26.2 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 26.1 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 25.4 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 25.3 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 25.2 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 25.1 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 24.4 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 24.4.0 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 24.3 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 24.2 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 24.1 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 23.3 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 23.2 | zlib (1.2.12) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 23.1 | zlib (1.2.12) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 22.4 | zlib (1.2.12) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 22.3 | zlib (1.2.12) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 22.2 | zlib (1.2.12) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 22.1 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 21.11 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 21.8 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 21.5.0 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 21.2.0 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 11.4.19.3667 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 11.4.18.3599 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 11.4.16.3445 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 11.4.15.3368 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 11.4.14.3263 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 11.4.13.3179 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 11.4.12.3054 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 11.4.11.3040 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 11.4.11.2990 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 11.4.10.2934 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 11.4.9.2878 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
| 11.4.8.2822 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is FFmpeg’s own TIFF decoder (tiff_unpack_zlib() in libavcodec/tiff.c), which ignores the actual uncompress() output length and memcpy()s all declared rows out of a partially-initialized heap buffer – the defect is in FFmpeg’s application-level handling of zlib’s result, not in zlib itself. Document Filters does not vendor, build, or link FFmpeg/libavcodec/libavformat in any form; no FFmpeg, tiff_unpack_zlib, or libavcodec reference exists anywhere in this codebase, so the vulnerable code is never compiled in. Document Filters decodes Deflate-compressed TIFF strips through libtiff 4.6.0 (external/libtiff-4.6.0/tif_zip.c, used by filters/isysgraphics/source/ISYStiff_decoder.cpp), whose ZIPDecode() already performs the equivalent check the FFmpeg fix adds: after the inflate loop it verifies the full expected output count was produced and, if bytes remain, raises ‘Not enough data at scanline %lu (short %PRIu64 bytes)’ and returns failure rather than emitting the uninitialized tail of the buffer. |
Severity score breakdown
Attack Complexity
LOW
Attack Vector
LOCAL
Availability Impact
NONE
Base Score
5.5
Base Severity
MEDIUM
Confidentiality Impact
HIGH
Integrity Impact
NONE
Privileges Required
NONE
Scope
UNCHANGED
User Interaction
REQUIRED
Vector String
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Version
3.1