CVE-2026-120246 in FFmpeg
Summary
by MITRE • 11/01/2026
FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/01/2026
The vulnerability identified within FFmpeg versions 4.4 through 9.0.2 represents a critical memory safety issue located specifically within the CDXL (Commodore Deluxe Paint) decoder module. This flaw is classified as an out-of-bounds read or uninitialized variable access, which falls under CWE-908 in the Common Weakness Enumeration taxonomy. The core technical defect arises from improper initialization of palette entries during the decoding process for HAM (Hold And Modify) pixel formats. When processing specific CDXL files, particularly those crafted to exploit this condition, the decoder fails to ensure that all necessary palette indices are populated before they are utilized to construct output pixels. This lack of validation allows uninitialized memory regions on the application stack to be read and subsequently written into the decoded image buffer.
The operational mechanism involves the functions cdxl_decode_ham8() and cdxl_decode_ham6(), which handle HAM-8 and HAM-6 pixel decoding respectively. In these routines, when a type-0 CDXL file is processed, certain palette entries may remain unfilled due to malformed or specially crafted input data. Instead of defaulting to safe values such as black or white, the decoder proceeds to use whatever residual data exists at those memory addresses on the stack. Consequently, sensitive information from previous function calls, including local variables and potentially pointer fragments, is embedded directly into the BGR24 output buffer. This behavior effectively transforms a standard media decoding error into an arbitrary read primitive, allowing external actors to extract internal application state that was not intended for exposure.
The impact of this vulnerability extends beyond simple data corruption or application crashes. By leaking stack memory contents, attackers can potentially reconstruct sensitive information such as authentication tokens, encryption keys, or other confidential data processed by the FFmpeg instance during prior operations. This aligns with ATT&CK technique T1083, which covers File and Directory Discovery, although in this context it is more accurately described as Information Exposure through Memory Leakage (CWE-200). The ability to read arbitrary stack memory significantly increases the attack surface, potentially facilitating further exploitation vectors such as remote code execution if combined with other vulnerabilities or specific heap layout techniques.
Mitigation strategies for this vulnerability primarily involve updating FFmpeg to a version newer than 9.0.2 where these initialization checks have been corrected. Developers integrating FFmpeg into their applications should ensure that dependency management systems are configured to pull the latest stable releases automatically. For environments where immediate patching is not feasible, input validation at the application layer can serve as a temporary compensating control by rejecting CDXL files with malformed headers or unexpected palette structures before they reach the decoder. Additionally, enabling Address Sanitizer during development and testing phases can help detect similar uninitialized variable usage patterns in custom builds of FFmpeg, ensuring that such memory safety issues are identified prior to deployment in production environments.