CVE-2026-120243

MEDIUM 5.5

FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.

CWE	CWE-457
Vendor	ffmpeg
Product	ffmpeg
Published	Nov 1, 2026

Stay Ahead of the Next One

Get instant alerts for ffmpeg ffmpeg

Be the first to know when new medium vulnerabilities affecting ffmpeg ffmpeg are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

FFmpeg / FFmpeg

2.0 ≤ 9.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24858 github.com: https://github.com/FFmpeg/FFmpeg/commit/edad2d0dafcf44fa315eab716fd0183ce808053b github.com: https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/g2meet.c#L1040-L1042 github.com: https://github.com/FFmpeg/FFmpeg vulncheck.com: https://www.vulncheck.com/advisories/ffmpeg-2.0-through-9.0.2-information-disclosure-via-g2m-kempf-palette

Credits

Adrian Junge (vurlo)