CVE-2026-120244 — Vulnerability intelligence

—

Published: 2026-11-01T01:17:17.787

CVSS

6.8

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into visible decoded pixels.

Sources

• CVE-2026-120244
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory