CVE-2026-120245

MEDIUM 5.5

FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.

CWE	CWE-908
Vendor	ffmpeg
Product	ffmpeg
Published	Nov 1, 2026

Stay Ahead of the Next One

Get instant alerts for ffmpeg ffmpeg

Be the first to know when new medium vulnerabilities affecting ffmpeg ffmpeg are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

FFmpeg / FFmpeg

0.10 ≤ 9.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877 github.com: https://github.com/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180 github.com: https://github.com/FFmpeg/FFmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e github.com: https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c#L188-L194 github.com: https://github.com/FFmpeg/FFmpeg vulncheck.com: https://www.vulncheck.com/advisories/ffmpeg-0.10-through-9.0.2-uninitialized-memory-disclosure-via-sun-raster-decoder

Credits

Adrian Junge (vurlo)