6.8
Medium
CVE-2026-120247 FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows…
Description
FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FFMPEG 2.3 | 2.3 → 9.0.2 | No fix stated |
References
- code.ffmpeg.org code.ffmpeg.org
- github.com github.com
- github.com github.com
- github.com github.com
- VulnCheck Advisory: FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure www.vulncheck.com
Timeline
- Published
- Last modified
Other CVEs of FFMPEG
The 83 CVEs of FFMPEG →
CVE-2026-120246
FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder
6.8
Medium
CVE-2026-120245
FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks…
6.8
Medium
CVE-2026-120244
FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers…
6.8
Medium
CVE-2026-120243
FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows…
6.8
Medium