CVE-2026-120245
Last modified
CVE-2026-120245 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output..
Description
FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| FFmpeg | FFmpeg | >= 0.10, <= 9.0.2 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-120245?
How severe is CVE-2026-120245?
How do I fix CVE-2026-120245?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-12024Insufficient policy enforcement in DevTools in Google Chrome…6.5
- CVE-2026-120240A vulnerability was determined in WAVLINK WN553X1-B V260403_…9.9
- CVE-2026-120241A vulnerability was identified in Ruijie RG-ES205GC, RG-ES20…7.5
- CVE-2026-120242A security flaw has been discovered in Ruijie RG-ES205GC, RG…2.4
- CVE-2026-120243FFmpeg 2.0 through 9.0.2 contains a use of uninitialized var…5.5
- CVE-2026-120244FFmpeg 2.1 through 9.0.2 contains a use of uninitialized res…5.5
- CVE-2026-120246FFmpeg 4.4 through 9.0.2 contains a use of uninitialized var…5.5
- CVE-2026-120247FFmpeg 2.3 through 9.0.2 contains a use of uninitialized res…5.5
- CVE-2026-120248Thelia before 3.1.1 contains a stored cross-site scripting v…4.8
- CVE-2026-120249Thelia Back-office Default Twig Template before 1.1.1 contai…6.5
- CVE-2026-12025Insufficient validation of untrusted input in Network in Goo…5.3
- CVE-2026-120250OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certif…5.3
Are you affected by CVE-2026-120245?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST