Vulnerability Description
FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877
- https://github.com/FFmpeg/FFmpeg
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c#L188-L194
- https://github.com/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180
- https://github.com/FFmpeg/FFmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e
- https://www.vulncheck.com/advisories/ffmpeg-0.10-through-9.0.2-uninitialized-mem
FAQ
What is CVE-2026-120245?
CVE-2026-120245 is a vulnerability with a CVSS score of 5.5 (MEDIUM). FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. At...
How severe is CVE-2026-120245?
CVE-2026-120245 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-120245?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.