CVE-2026-120245 — Vulnerability intelligence
—
Published:
- CVSS
- 6.8
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.