Cloudanix VulnDB

CVE-2026-120245

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Nov 1, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Video software can accidentally reveal pieces of its working memory when it tries to read certain damaged image files.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Data Exposure
Component
Library
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use of uninitialized heap memory in sunrast_decode_frame() causes stale allocator data to be emitted into decoded PAL8 pixel output when processing truncated 1-bit or 4-bit Sun Raster images.

Why it matters to the business

Attackers who supply specially crafted image files to video or image processing pipelines can obtain fragments of process memory, potentially exposing secrets or internal data structures; the issue is new and unexploited in the wild so immediate operational risk remains low.

How an attack unfolds

An attacker prepares a truncated paletted Sun Raster file and causes the vulnerable decoder to process it, resulting in the uncleared temporary bitmap being expanded and written to the output frame where heap contents become visible to the caller.

How to fix it

Upgrade to a patched FFmpeg release that properly initializes the temporary bitmap before expansion; until a fix is available, disable or sandbox processing of untrusted Sun Raster images.

How to confirm the fix worked

Rebuild or obtain a version containing the initialization fix and confirm that crafted truncated test files no longer emit allocator metadata in decoded frames.

Typical attack path

  1. Craft a truncated 1-bit or 4-bit paletted Sun Raster image that triggers the uninitialized buffer path
  2. Deliver the file to any FFmpeg-based media pipeline that invokes sunrast_decode_frame()
  3. Observe decoded output frames that contain leaked heap words

How to detect it

Review application or media-processing logs for Sun Raster decode operations on files whose size or header fields indicate truncation; inspect decoded output frames for non-image data patterns consistent with heap metadata.

What your security team should do

  • Treat all Sun Raster decoding as untrusted input until a fixed build is deployed
  • Monitor upstream FFmpeg releases for the corrective patch and schedule update within normal change windows
  • Add file-type filtering or sandboxing for Sun Raster content in high-sensitivity pipelines

The record

FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities