Skip to content
fr Sign in
6.8 Medium

CVE-2026-120245 FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks…

Description

FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.

Affected products and versions

Product Affected versions Fixed in
FFMPEG 0.10 0.10 → 9.0.2 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of FFMPEG

The 83 CVEs of FFMPEG →
CVE-2026-120247 FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows… 6.8 Medium CVE-2026-120246 FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder 6.8 Medium CVE-2026-120244 FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers… 6.8 Medium CVE-2026-120243 FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows… 6.8 Medium
Track this CVE