Skip to content
Sign in
6.8 Medium

CVE-2026-120247 FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure

Description

FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents.

CVSS 4.0 detail

Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Exploitable with local access to the machine, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Local
Attack complexity
Low
Attack requirements
None
Privileges required
None
Interaction
Passive
Confidentiality
High
Integrity
None
Availability
None
Confidentiality of other systems
None
Integrity of other systems
None
Availability of other systems
None

Affected products and versions

Product Affected versions Fixed in
FFMPEG 2.3 2.3 → 9.0.2 No fix stated

Other CVEs of FFMPEG

The 83 CVEs of FFMPEG →
CVE-2026-120246 FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder 6.8 Medium CVE-2026-120245 FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks… 6.8 Medium CVE-2026-120244 FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers… 6.8 Medium CVE-2026-120243 FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette 6.8 Medium
Track this CVE