CVE-2026-120247 — Vulnerability intelligence

—

Published: 2026-11-01T01:17:18.323

CVSS

6.8

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents.

Sources

• CVE-2026-120247
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory