FFmpeg versions 0.5 through 8.x contain a flaw in the native TIFF decoder within libavcodec/tiff.c, identified as CWE-908 (Uninitialized Heap Memory Write) and CWE-824 (Uninitialized Heap Memory Read). When a TIFF file includes a Deflate‑compressed strip that ends early, the decoder allocates a buffer sized for the full declared strip but copies all rows via memcpy regardless of how many bytes zlib actually decompresses. This causes unwritten portions of the buffer—potentially containing stale data from previous heap allocations—to be incorporated into the decoded image output, resulting in a loss of confidentiality as unintended data becomes visible in the final image.

All FFmpeg binaries from 0.5 up to, but not including, 9.0 are affected. The vulnerability resides in libavcodec/tiff.c, so any application, media service, or system that embeds or links against these FFmpeg versions and processes TIFF files is susceptible. No subcomponent or patch level within this range provides inherent protection.

The CVSS score of 6.8 indicates moderate severity, and an EPSS score of <1% suggests a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no widespread active exploitation is known. However, exploitation only requires an attacker to supply a malicious TIFF to a service that uses FFmpeg for decoding, a common capability in many media handling applications. Consequently, the risk remains significant for systems that accept external TIFF inputs, and proper remediation should be undertaken promptly.