Cloudanix VulnDB

CVE-2026-120244

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Nov 1, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in widely used video software can accidentally reveal hidden data from memory when opening certain image files, which might expose private information.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Library
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use of uninitialized resource in FFmpeg PCX decoder where truncated RLE scanlines in pcx_decode_frame() cause av_malloc() buffer contents to be copied into decoded output pixels, disclosing heap memory.

Why it matters to the business

Processing untrusted PCX images in media workflows can leak sensitive heap data, risking exposure of confidential information with minimal attacker effort.

How an attack unfolds

Attacker creates a PCX image with prematurely ending RLE data. When FFmpeg decodes it, pcx_decode_frame() copies uninitialized heap memory into visible pixels, allowing the attacker to inspect leaked contents from the decoded image.

How to fix it

Upgrade FFmpeg to a version newer than 9.0.2 containing the PCX decoder fix. Until patched, disable PCX support or restrict decoding to trusted sources only.

How to confirm the fix worked

Confirm FFmpeg version exceeds 9.0.2, then test with crafted truncated-RLE PCX samples to verify no uninitialized memory appears in output pixels.

Typical attack path

  1. Craft PCX image containing truncated RLE scanlines
  2. Deliver image to target application using vulnerable FFmpeg
  3. Trigger PCX decoding via pcx_decode_frame()
  4. Inspect decoded output for leaked heap memory contents

How to detect it

Review application logs for PCX file processing events; inspect decoded image outputs or crash dumps for unexpected non-image data patterns originating from heap buffers.

What your security team should do

  • Prioritize upgrade of all FFmpeg installations within 30 days given public disclosure
  • Block or sandbox untrusted PCX file processing in media pipelines
  • Add PCX decoder logging to detect anomalous image handling

The record

FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into visible decoded pixels.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities