{"id":"CVE-2026-120247","aliases":["DEBIAN-CVE-2026-120247","EUVD-2026-114744","GHSA-rp9m-mw76-ppmp","OESA-2026-4806","OESA-2026-4807","OESA-2026-4808","OESA-2026-4809","UBUNTU-CVE-2026-120247"],"status":"published","title":"FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure","description":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s-\u003etemp[0] bytes into output frames, exposing heap contents.","severity":{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00124,"percentile":0.02146,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-908"],"published":"2026-11-01T00:57:12Z","modified":"2026-11-11T12:45:08Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:5.1.3-1","7:5.1.3-2","7:5.1.4-0+deb12u1","7:5.1.5-0+deb12u1","7:5.1.6-0+deb12u1","7:5.1.7-0+deb12u1","7:5.1.8-0+deb12u1","7:5.1.9-0+deb12u1","7:6.0-1","7:6.0-2","7:6.0-3","7:6.0-4","7:6.0-5","7:6.0-6","7:6.0-7","7:6.0-8","7:6.0-9","7:6.1-1","7:6.1-2","7:6.1-3","7:6.1-4","7:6.1-5","7:6.1.1-1","7:6.1.1-2","7:6.1.1-3","7:6.1.1-4","7:6.1.1-5","7:7.0-1","7:7.0.1-1","7:7.0.1-2","7:7.0.1-3","7:7.0.1-4","7:7.0.1-5","7:7.0.2-1","7:7.0.2-2","7:7.0.2-3","7:7.1-1","7:7.1-2","7:7.1-3","7:7.1-4","7:7.1.1-1","7:7.1.2-1","7:7.1.3-1","7:8.0-1","7:8.0-2","7:8.0.1-1","7:8.0.1-2","7:8.0.1-3","7:8.1-1","7:8.1-2","7:8.1-3","7:8.1.1-1","7:8.1.1-2","7:8.1.1-3","7:8.1.1-4","7:8.1.2-1","7:8.1.2-2","7:9.0-1","7:9.0.1-1","7:9.0.2-1","7:9.0.2-2","7:9.0.2-3","7:9.0.2-4"]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:7.1.1-1","7:7.1.2-0+deb13u1","7:7.1.2-1","7:7.1.3-0+deb13u1","7:7.1.3-1","7:7.1.4-0+deb13u1","7:7.1.5-0+deb13u1","7:8.0-1","7:8.0-2","7:8.0.1-1","7:8.0.1-2","7:8.0.1-3","7:8.1-1","7:8.1-2","7:8.1-3","7:8.1.1-1","7:8.1.1-2","7:8.1.1-3","7:8.1.1-4","7:8.1.2-1","7:8.1.2-2","7:9.0-1","7:9.0.1-1","7:9.0.2-1","7:9.0.2-2","7:9.0.2-3","7:9.0.2-4"]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:7.1.1-1","7:7.1.2-1","7:7.1.3-1","7:8.0-1","7:8.0-2","7:8.0.1-1","7:8.0.1-2","7:8.0.1-3","7:8.1-1","7:8.1-2","7:8.1-3","7:8.1.1-1","7:8.1.1-2","7:8.1.1-3","7:8.1.1-4","7:8.1.2-1","7:8.1.2-2","7:9.0-1","7:9.0.1-1","7:9.0.2-1","7:9.0.2-2","7:9.0.2-3","7:9.0.2-4"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-54.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-54.oe2403sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-59.oe2203sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-54.oe2403sp1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6:0.8.7-1ubuntu2","6:9.10-1ubuntu1","6:9.10-1ubuntu2","6:9.10-1ubuntu5","6:9.10-1ubuntu6","6:9.10-1ubuntu7","6:9.11-2ubuntu1","6:9.11-2ubuntu2","6:9.13-0ubuntu0.14.04.1","6:9.14-0ubuntu0.14.04.1","6:9.16-0ubuntu0.14.04.1","6:9.18-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1","6:9.20-0ubuntu0.14.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:2.7.2-1build1","7:2.8.1-1ubuntu1","7:2.8.2-1ubuntu1","7:2.8.3-1","7:2.8.4-1","7:2.8.4-1ubuntu1","7:2.8.4-1ubuntu2","7:2.8.4-1ubuntu3","7:2.8.4-1ubuntu4","7:2.8.6-1ubuntu1","7:2.8.6-1ubuntu2","7:2.8.8-0ubuntu0.16.04.1","7:2.8.10-0ubuntu0.16.04.1","7:2.8.11-0ubuntu0.16.04.1","7:2.8.14-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1","7:2.8.15-0ubuntu0.16.04.1+esm1","7:2.8.17-0ubuntu0.1","7:2.8.17-0ubuntu0.1+esm1","7:2.8.17-0ubuntu0.1+esm2","7:2.8.17-0ubuntu0.1+esm3","7:2.8.17-0ubuntu0.1+esm4","7:2.8.17-0ubuntu0.1+esm5","7:2.8.17-0ubuntu0.1+esm6","7:2.8.17-0ubuntu0.1+esm7","7:2.8.17-0ubuntu0.1+esm8","7:2.8.17-0ubuntu0.1+esm9","7:2.8.17-0ubuntu0.1+esm10","7:2.8.17-0ubuntu0.1+esm11","7:2.8.17-0ubuntu0.1+esm12","7:2.8.17-0ubuntu0.1+esm13","7:2.8.17-0ubuntu0.1+esm14","7:2.8.17-0ubuntu0.1+esm15","7:2.8.17-0ubuntu0.1+esm16","7:2.8.17-0ubuntu0.1+esm17","7:2.8.17-0ubuntu0.1+esm18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:3.3.4-2","7:3.3.4-2build3","7:3.4-2ubuntu2","7:3.4-4","7:3.4-4build1","7:3.4.1-1","7:3.4.1-1build1","7:3.4.2-1","7:3.4.2-1build1","7:3.4.2-2","7:3.4.4-0ubuntu0.18.04.1","7:3.4.6-0ubuntu0.18.04.1","7:3.4.8-0ubuntu0.2","7:3.4.11-0ubuntu0.1","7:3.4.11-0ubuntu0.1+esm1","7:3.4.11-0ubuntu0.1+esm2","7:3.4.11-0ubuntu0.1+esm3","7:3.4.11-0ubuntu0.1+esm4","7:3.4.11-0ubuntu0.1+esm5","7:3.4.11-0ubuntu0.1+esm6","7:3.4.11-0ubuntu0.1+esm7","7:3.4.11-0ubuntu0.1+esm8","7:3.4.11-0ubuntu0.1+esm9","7:3.4.11-0ubuntu0.1+esm10","7:3.4.11-0ubuntu0.1+esm11","7:3.4.11-0ubuntu0.1+esm12","7:3.4.11-0ubuntu0.1+esm13","7:3.4.11-0ubuntu0.1+esm14","7:3.4.11-0ubuntu0.1+esm15","7:3.4.11-0ubuntu0.1+esm16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:4.1.4-1build2","7:4.2.1-2","7:4.2.1-2ubuntu1","7:4.2.2-1build1","7:4.2.2-1ubuntu1","7:4.2.4-1ubuntu0.1","7:4.2.4-1ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1","7:4.2.7-0ubuntu0.1+esm1","7:4.2.7-0ubuntu0.1+esm2","7:4.2.7-0ubuntu0.1+esm3","7:4.2.7-0ubuntu0.1+esm4","7:4.2.7-0ubuntu0.1+esm5","7:4.2.7-0ubuntu0.1+esm6","7:4.2.7-0ubuntu0.1+esm7","7:4.2.7-0ubuntu0.1+esm8","7:4.2.7-0ubuntu0.1+esm9","7:4.2.7-0ubuntu0.1+esm10","7:4.2.7-0ubuntu0.1+esm11","7:4.2.7-0ubuntu0.1+esm12","7:4.2.7-0ubuntu0.1+esm13","7:4.2.7-0ubuntu0.1+esm14","7:4.2.7-0ubuntu0.1+esm15","7:4.2.7-0ubuntu0.1+esm16","7:4.2.7-0ubuntu0.1+esm17","7:4.2.7-0ubuntu0.1+esm18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:4.4-6ubuntu5","7:4.4.1-2ubuntu1","7:4.4.1-3ubuntu1","7:4.4.1-3ubuntu2","7:4.4.1-3ubuntu3","7:4.4.1-3ubuntu5","7:4.4.2-0ubuntu0.22.04.1","7:4.4.2-0ubuntu0.22.04.1+esm1","7:4.4.2-0ubuntu0.22.04.1+esm2","7:4.4.2-0ubuntu0.22.04.1+esm3","7:4.4.2-0ubuntu0.22.04.1+esm4","7:4.4.2-0ubuntu0.22.04.1+esm5","7:4.4.2-0ubuntu0.22.04.1+esm6","7:4.4.2-0ubuntu0.22.04.1+esm7","7:4.4.2-0ubuntu0.22.04.1+esm8","7:4.4.2-0ubuntu0.22.04.1+esm9","7:4.4.2-0ubuntu0.22.04.1+esm10","7:4.4.2-0ubuntu0.22.04.1+esm11","7:4.4.2-0ubuntu0.22.04.1+esm12","7:4.4.2-0ubuntu0.22.04.1+esm13","7:4.4.2-0ubuntu0.22.04.1+esm14","7:4.4.2-0ubuntu0.22.04.1+esm15","7:4.4.2-0ubuntu0.22.04.1+esm16","7:4.4.2-0ubuntu0.22.04.1+esm17"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:6.0-6ubuntu1","7:6.0-9ubuntu1","7:6.1-2ubuntu1","7:6.1-3ubuntu1","7:6.1-4ubuntu1","7:6.1-5ubuntu1","7:6.1.1-1ubuntu1","7:6.1.1-3ubuntu1","7:6.1.1-3ubuntu5","7:6.1.1-3ubuntu5+esm1","7:6.1.1-3ubuntu5+esm2","7:6.1.1-3ubuntu5+esm3","7:6.1.1-3ubuntu5+esm4","7:6.1.1-3ubuntu5+esm5","7:6.1.1-3ubuntu5+esm6","7:6.1.1-3ubuntu5+esm7","7:6.1.1-3ubuntu5+esm8","7:6.1.1-3ubuntu5+esm10","7:6.1.1-3ubuntu5+esm11","7:6.1.1-3ubuntu5+esm12","7:6.1.1-3ubuntu5+esm13","7:6.1.1-3ubuntu5+esm15"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:8.0.1-3ubuntu2","7:8.1-3ubuntu3","7:8.1.2-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7:7.1.1-1ubuntu4","7:7.1.2-1ubuntu3","7:7.1.2-1ubuntu4","7:7.1.3-1ubuntu1","7:8.0.1-2ubuntu1","7:8.0.1-3ubuntu1","7:8.0.1-3ubuntu2","7:8.0.1-3ubuntu2+esm1","7:8.0.1-3ubuntu2+esm3","7:8.0.1-3ubuntu2+esm4","7:8.0.1-3ubuntu2+esm5"]}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24869","tags":["issue-tracking","report"]},{"url":"https://github.com/FFmpeg/FFmpeg/commit/7c73707355708c846f718cca90096bc1a33c8989","tags":["patch","fix","report"]},{"url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/huffyuvdec.c#L802","tags":["technical-description","article","report"]},{"url":"https://github.com/FFmpeg/FFmpeg","tags":["product","package","report"]},{"url":"https://www.vulncheck.com/advisories/ffmpeg-2.3-through-9.0.2-huffyuv-decoder-uninitialized-heap-memory-disclosure","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120247","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rp9m-mw76-ppmp"},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120247.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-120247","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4806","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120243","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120245","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120246","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4807","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4808","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4809","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-120247","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-120247","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-120247","title":"FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure","description":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s-\u003etemp[0] bytes into output frames, exposing heap contents.","status":"published","published":"2026-11-01T00:57:12.137Z","modified":"2026-11-06T18:56:15.087Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-908"],"updated_at":"2026-11-06T19:59:19.701997Z"}],"euvd":[{"id":"EUVD-2026-114744","description":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s-\u003etemp[0] bytes into output frames, exposing heap contents.","status":"published","published":"2026-11-01T00:57:12Z","modified":"2026-11-06T18:56:15Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-06T20:06:05.664912Z"}],"ghsa":[{"id":"GHSA-rp9m-mw76-ppmp","title":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv...","description":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s-\u003etemp[0] bytes into output frames, exposing heap contents.","status":"published","published":"2026-11-01T03:30:37Z","modified":"2026-11-01T03:30:38Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T15:14:54.535223Z"}],"nvd":[{"id":"CVE-2026-120247","description":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s-\u003etemp[0] bytes into output frames, exposing heap contents.","status":"published","published":"2026-11-01T01:17:18.323Z","modified":"2026-11-06T19:17:42.31Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-908"],"updated_at":"2026-11-06T22:02:16.10095Z"}],"osv":[{"id":"CVE-2026-120247","title":"FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure","description":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s-\u003etemp[0] bytes into output frames, exposing heap contents.","status":"published","published":"2026-11-01T00:57:12.137Z","modified":"2026-11-08T07:05:59.125886088Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-908"],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2026-120247","description":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s-\u003etemp[0] bytes into output frames, exposing heap contents.","status":"published","published":"2026-11-01T01:17:18.323Z","modified":"2026-11-07T10:01:04.472778826Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-07T10:14:19.880839Z"},{"id":"OESA-2026-4806","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nFFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer\u0026apos;s mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.(CVE-2026-107678)\n\nFFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.(CVE-2026-120243)\n\nFFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into visible decoded pixels.(CVE-2026-120244)\n\nFFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.(CVE-2026-120245)\n\nFFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output.(CVE-2026-120246)\n\nFFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s-\u0026gt;temp[0] bytes into output frames, exposing heap contents.(CVE-2026-120247)","status":"published","published":"2026-11-11T12:26:21Z","modified":"2026-11-11T12:45:07.947508728Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4807","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nFFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer\u0026apos;s mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.(CVE-2026-107678)\n\nFFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.(CVE-2026-120243)\n\nFFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into visible decoded pixels.(CVE-2026-120244)\n\nFFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.(CVE-2026-120245)\n\nFFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output.(CVE-2026-120246)\n\nFFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s-\u0026gt;temp[0] bytes into output frames, exposing heap contents.(CVE-2026-120247)","status":"published","published":"2026-11-11T12:26:21Z","modified":"2026-11-11T12:45:07.502867302Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4808","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nFFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer\u0026apos;s mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.(CVE-2026-107678)\n\nFFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.(CVE-2026-120243)\n\nFFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into visible decoded pixels.(CVE-2026-120244)\n\nFFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.(CVE-2026-120245)\n\nFFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output.(CVE-2026-120246)\n\nFFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s-\u0026gt;temp[0] bytes into output frames, exposing heap contents.(CVE-2026-120247)","status":"published","published":"2026-11-11T12:26:22Z","modified":"2026-11-11T12:45:08.003813095Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4809","title":"ffmpeg security update","description":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nFFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer\u0026apos;s mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.(CVE-2026-107678)\n\nFFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.(CVE-2026-120243)\n\nFFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into visible decoded pixels.(CVE-2026-120244)\n\nFFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.(CVE-2026-120245)\n\nFFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output.(CVE-2026-120246)\n\nFFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s-\u0026gt;temp[0] bytes into output frames, exposing heap contents.(CVE-2026-120247)","status":"published","published":"2026-11-11T12:26:23Z","modified":"2026-11-11T12:45:08.004112626Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"UBUNTU-CVE-2026-120247","description":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s-\u003etemp[0] bytes into output frames, exposing heap contents.","status":"published","published":"2026-11-01T01:17:00Z","modified":"2026-11-05T04:42:52Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-05T13:33:25.727744Z"}]}}