CVE-2026-120247 in FFmpeg
Summary
by MITRE • 11/01/2026
FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/01/2026
The vulnerability identified in FFmpeg versions 2.3 through 9.0.2 represents a critical memory safety issue within the Huffyuv video decoder component. This flaw is classified as an improper initialization of a resource, specifically involving uninitialized memory access. The root cause lies in the decode_slice function, which processes entropy-coded data for Huffyuv streams. When decoding short packed-BGR bitstreams where the entropy data terminates prematurely or ends early relative to expected frame dimensions, the decoder fails to properly initialize temporary buffer variables before using them. Specifically, the variable s->temp[0] is utilized in constructing output frames without being fully zeroed out or populated with valid pixel data from the stream. Consequently, any remaining bytes that are not overwritten by actual decoded pixel information retain their previous state in memory.
This technical flaw leads to a direct heap-based buffer over-read condition where uninitialized memory contents are copied into the final video frame pixels. Because FFmpeg operates on complex media processing pipelines often used in web browsers, streaming services, and local playback applications, this vulnerability allows an attacker who crafts a malicious Huffyuv BGR24 or BGRA video file to trigger the leak during decoding. The operational impact is significant as it enables information disclosure through memory leakage. An adversary can potentially extract sensitive data from the heap of the process running FFmpeg, such as cryptographic keys, session tokens, passwords, or other private user data that was previously allocated in adjacent memory regions and not yet overwritten by new allocations.
From a classification perspective, this vulnerability aligns with CWE-908, which denotes Use of Uninitialized Resource, and more broadly falls under the category of Improper Input Validation when considering how the decoder handles truncated or malformed input streams. In terms of adversary tactics, this exploitation vector corresponds to ATT&CK technique T1537, specifically the sub-technique of Transfer Data to Cloud Account via Exfiltrated Information if the leaked data is transmitted externally, though primarily it serves as a mechanism for local information gathering and potential further lateral movement depending on the context in which FFmpeg is deployed. The lack of bounds checking or explicit initialization before memory copy operations creates an exploitable gap that security researchers have historically targeted to achieve arbitrary code execution via subsequent heap corruption techniques if combined with other vulnerabilities, although this specific instance focuses on data leakage.
Mitigation strategies for this vulnerability require immediate updates to the FFmpeg library across all affected versions up to 9.0.2. Organizations relying on FFmpeg should patch their dependencies and ensure that build systems are configured to pull in security fixes promptly. For developers integrating FFmpeg into custom applications, it is advisable to implement strict input validation layers before passing media streams to the decoder engine. This includes verifying stream integrity and length expectations prior to initiating decode operations. Additionally, deploying runtime protection mechanisms such as Address Sanitizer during development phases can help detect similar uninitialized memory access issues early in the software lifecycle. Security teams should also monitor for any reported incidents involving unusual heap activity or data exfiltration attempts linked to media processing services that utilize vulnerable versions of FFmpeg.