Cloudanix VulnDB

CVE-2026-120246

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Nov 1, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A video-processing tool can accidentally include pieces of its own internal memory in the pictures it produces when handling certain old video files, which might let someone see information they should not.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Library
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use of uninitialized variable in the CDXL decoder leaks stack memory into decoded pixels through unfilled HAM palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in BGR24 output.

Why it matters to the business

Attackers may obtain sensitive memory contents from systems processing untrusted CDXL video files, potentially revealing internal data structures or pointers with minimal attacker effort.

How an attack unfolds

An attacker creates a specially crafted type-0 CDXL file that causes the decoder to reference unfilled palette entries, then tricks a target into processing the file with an affected FFmpeg version so that stack contents are written into the resulting pixel data.

How to fix it

Upgrade FFmpeg to a version that properly initializes the HAM palette before use; until patches are available, avoid processing untrusted CDXL files and consider disabling the CDXL decoder where possible.

How to confirm the fix worked

Rebuild or obtain a patched FFmpeg binary, re-decode the same crafted test file, and confirm that no stack-derived bytes appear in the BGR24 output; scan build logs or binary for the corrected palette initialization logic.

Typical attack path

  1. Craft a malicious type-0 CDXL file that triggers unfilled HAM palette entries
  2. Deliver the file to the victim via email, download, or media
  3. Victim application invokes FFmpeg CDXL decoding on the file
  4. Uninitialized stack memory is copied into BGR24 output pixels
  5. Attacker inspects the decoded output to recover leaked stack bytes and pointers

How to detect it

Review media-processing logs for CDXL file handling around the time of suspected exposure; examine decoded output images for anomalous pixel patterns that could indicate memory leakage; correlate with process execution of ffmpeg or related tools on systems that process untrusted media.

What your security team should do

  • Prioritize patching FFmpeg within the next 30 days given the public disclosure and recent publication date
  • Add CDXL decoder to the list of high-risk codecs and restrict its use in media-processing pipelines
  • Update file-type allow-lists to block CDXL files from untrusted sources until fixed builds are deployed

The record

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities