CVE-2026-120245

    Dashboard / Vulnerabilities / CVE-2026-120245

    CVE-2026-120245

    Published: 1 Nov 2026Last Modified: 4 Nov 2026

    Summary: FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder

    Details: FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.

    References: https://code.ffmpeg.org/FFmpeg/FFmpeg, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120245.json, https://nvd.nist.gov/vuln/detail/CVE-2026-120245, https://www.vulncheck.com/advisories/ffmpeg-0.10-through-9.0.2-uninitialized-memory-disclosure-via-sun-raster-decoder, https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877, https://github.com/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180, https://github.com/FFmpeg/FFmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e, https://github.com/FFmpeg/FFmpeg, https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c#L188-L194

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 7e16636995fd6710164f7622cd77abc94c27a064
    Fixed -356a391bf57df2fb80fd61f2821c8c83d15ce180

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High