CVE-2026-120243

What it actually does

Use of an uninitialized variable in the Go2Meeting decoder allows out-of-range palette indices to cause kempf_restore_buf() to copy stack bytes (including pointers and guards) into decoded frame output from crafted G2M3/G2M4 streams.

Why it matters to the business

Processing untrusted video files in FFmpeg can leak internal memory contents, creating a confidentiality risk for any workflow that decodes Go2Meeting streams; low exploit likelihood reduces immediate urgency.

How an attack unfolds

An attacker creates a G2M3 or G2M4 stream containing a deliberately short Kempf palette, feeds it to an application using the vulnerable FFmpeg decoder, and the uninitialized stack data is written into the decoded output buffer where it can be observed.

How to fix it

Upgrade FFmpeg to a version newer than 9.0.2 that initializes all variables in the Go2Meeting decoder before palette processing; rebuild dependent applications against the fixed library.

How to confirm the fix worked

Rebuild with the patched FFmpeg, feed the decoder a test stream containing a short Kempf palette, and confirm that no uninitialized stack bytes appear in the decoded output buffer.

Typical attack path

1. Craft a G2M3/G2M4 media stream with a short Kempf palette
2. Deliver the stream to a target application that uses FFmpeg for decoding
3. Trigger decoding of the malicious stream
4. Inspect the resulting decoded output for leaked stack memory

How to detect it

Inspect application logs and decoded output artifacts for unexpected binary data or pointer-like patterns after G2M stream processing; correlate with file-open events for G2M3/G2M4 containers.

What your security team should do

• Prioritize patching FFmpeg within normal update cycles given low EPSS and absence from KEV
• Restrict decoding of Go2Meeting streams from untrusted sources until patched
• Scan build pipelines and containers for FFmpeg versions 2.0-9.0.2
• Update media-processing dependencies as new fixed releases become available