Cloudanix VulnDB

CVE-2026-120247

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Nov 1, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A video-handling program can accidentally copy hidden memory contents into the pictures it produces, potentially revealing private information when certain video files are opened.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Library
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw causes decode_slice() in the Huffyuv decoder to copy uninitialized bytes from s->temp[0] into output frames when processing short packed-BGR bitstreams, leaking heap memory contents into decoded BGR24/BGRA pixels.

Why it matters to the business

Attackers may obtain sensitive data resident in application memory such as keys, credentials or user information, raising the risk of data exposure even though the issue is new with low observed exploitation rates.

How an attack unfolds

An attacker prepares a crafted Huffyuv BGR24 or BGRA video whose entropy data terminates early. When the file is decoded by a vulnerable FFmpeg installation the uninitialized bytes are placed into output pixels; the attacker then extracts the leaked heap contents from the resulting frame data.

How to fix it

Upgrade FFmpeg to the first release after 9.0.2 that resolves the uninitialized-resource issue in the Huffyuv decoder. Until a fix is available, avoid decoding untrusted Huffyuv BGR content or disable the decoder via build-time or runtime configuration.

How to confirm the fix worked

Test the decoder with specially crafted short packed-BGR bitstreams and confirm that decoded frames no longer contain bytes originating from uninitialized heap memory; review decoder source changes for proper initialization of s->temp before use.

Typical attack path

  1. Craft a Huffyuv video file containing a truncated packed-BGR bitstream
  2. Deliver the file to a target application that uses the vulnerable decoder
  3. Trigger decoding of the malicious video
  4. Inspect the decoded pixel data for leaked heap memory contents

How to detect it

Search application and media-processing logs for Huffyuv decoder activity on externally supplied files; inspect decoded frame buffers or saved images for anomalous non-image data patterns that could indicate memory leakage.

What your security team should do

  • Track FFmpeg release announcements and apply the corrective update as soon as it becomes available
  • Restrict processing of untrusted video files to isolated environments
  • Add runtime detection for Huffyuv decoder usage on external inputs

The record

FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities