SecNews@SecNews_GR
FFmpeg CVE-2026-120247: Διαρροή μνήμης στον Huffyuv https://www.secnews.gr/745637/ffmpeg-cve-2026-120247-huffyuv-memory/?fsp_sid=21889
0000099
7.0K followersView on X
CVE-2026-120247
LOWCVSS 6.8 · MEDIUMSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents.
0.0/ 10 priority
Sources & remediation
Other references
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24869
- https://github.com/FFmpeg/FFmpeg
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/huffyuvdec.c#L802
- https://github.com/FFmpeg/FFmpeg/commit/7c73707355708c846f718cca90096bc1a33c8989
- https://www.vulncheck.com/advisories/ffmpeg-2.3-through-9.0.2-huffyuv-decoder-uninitialized-heap-memory-disclosure
Weakness type (CWE)
CWE-908
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day