CVE-2026-120244 in FFmpeg
Summary
by MITRE • 11/01/2026
FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into visible decoded pixels.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/01/2026
The vulnerability identified in FFmpeg versions 2.1 through 9.0.2 represents a critical memory safety issue within the Picture Exchange format PCX decoder. This flaw is classified as an out-of-bounds read resulting from the use of uninitialized resources, specifically mapping to CWE-908 and often associated with information disclosure scenarios where sensitive data is exposed due improper initialization prior to access. The core technical defect lies in how the pcx_decode_frame function handles Run-Length Encoded RLE scanlines that are truncated or malformed within a crafted PCX image file. When an attacker provides a PCX file where the RLE data stream terminates prematurely, the decoder logic fails to properly bound-check the read operations against the allocated buffer size. Consequently, the decoding process proceeds beyond the valid end of the provided input data and continues reading into adjacent memory regions that have been previously allocated via av_malloc but not yet initialized with specific pixel values.
This uninitialized heap memory access allows an attacker to leak arbitrary contents from the application's heap space directly into the visible decoded pixels of the image output. The operational impact is severe, as it enables remote code execution vectors if combined with other exploitation techniques or facilitates sensitive information disclosure by revealing internal state data such as pointers, cryptographic keys, or user credentials that may reside in adjacent memory blocks. From a threat modeling perspective using the MITRE ATT&CK framework this behavior aligns with T1083 File and Directory Discovery when used for reconnaissance or more critically T1567 Exfiltration Over C2 Channel if the leaked data is transmitted externally, though primarily it falls under Memory Corruption leading to Information Leak. The vulnerability stems from a lack of rigorous validation on the length of RLE segments before copying them into the output buffer, allowing the decoder to perform memory reads that exceed the intended scope of the current frame's pixel array.
Mitigation strategies for this vulnerability require immediate updates to FFmpeg versions prior to 9.0.3 where these bounds checking mechanisms were corrected. Developers integrating FFmpeg should ensure their build environments are configured with AddressSanitizer or similar dynamic analysis tools during testing phases to detect such out-of-bounds reads early in the development lifecycle. Additionally, input validation layers at the application level can be implemented to inspect PCX files for structural integrity before passing them to the decoder, ensuring that RLE data lengths do not exceed expected bounds based on image dimensions and color depth specifications defined by the PCX standard. Security teams should also monitor for any signs of heap corruption or anomalous memory access patterns in production environments running affected versions as a proactive defense measure against potential exploitation attempts leveraging this specific uninitialized resource flaw.