CVE-2026-120245 in FFmpeg
Summary
by MITRE • 11/01/2026
FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/01/2026
The vulnerability identified within FFmpeg versions ranging from 0.10 through 9.0.2 represents a critical memory safety issue located specifically within the sunrast_decode_frame function responsible for processing Sun Raster image formats. This flaw is classified as an uninitialized resource vulnerability, which fundamentally stems from improper initialization of internal data structures prior to their use in decoding operations. The core technical deficiency involves temporary bitmap buffers that are allocated on the heap but fail to be cleared or zeroed out before being populated with pixel data during the processing of truncated input files. This lack of memory sanitization creates a scenario where residual data previously held by other allocations remains present in these buffer regions, effectively turning them into sources of information leakage rather than clean containers for new image data.
The operational impact of this vulnerability is most pronounced when an attacker crafts malicious Sun Raster images that are truncated or malformed, specifically targeting the handling of 1-bit and 4-bit paletted formats known as PAL8. When FFmpeg attempts to decode these crafted files, the decoding logic expands the uncleared temporary bitmap into pixel values without ensuring that all memory regions have been initialized. Consequently, any heap memory locations within those buffers that were not explicitly overwritten by valid image data retain their previous contents. This results in the exposure of stale heap information directly embedded within the decoded output stream. Such exposed data can include sensitive allocator metadata, internal pointers, or other confidential information previously stored on the process heap, thereby facilitating potential remote information disclosure attacks against systems running vulnerable versions of FFmpeg.
From a classification perspective, this vulnerability aligns with CWE-908, which denotes Use of Uninitialized Resource, and falls under the broader category of memory corruption issues that compromise data integrity and confidentiality. In terms of adversarial tactics as defined by the MITRE ATT&CK framework, this flaw supports Information Discovery techniques where an attacker leverages software vulnerabilities to extract sensitive information from a target system without direct access credentials. The ability to leak heap contents provides attackers with valuable intelligence about the internal state of the application, which can be instrumental in chaining further exploits or bypassing security controls that rely on memory randomization or isolation assumptions.
Mitigation strategies for this vulnerability primarily involve updating FFmpeg to version 9.0.3 or later, where the issue has been addressed by ensuring proper initialization of temporary buffers before use during the decoding process. For environments unable to immediately upgrade, implementing strict input validation and sanitization at the ingestion layer can help prevent the processing of truncated or malformed Sun Raster files. Additionally, deploying runtime protection mechanisms such as Address Sanitizer in development builds or utilizing memory-safe wrappers in production deployments can provide an additional layer of defense against uninitialized memory access errors. Organizations should also consider restricting the use of FFmpeg to trusted sources and monitoring for anomalous behavior indicative of heap exploitation attempts within their multimedia processing pipelines.