Information Disclosure Vulnerability in FFmpeg Product by FFmpeg

CVE-2026-120243

What is CVE-2026-120243?

FFmpeg versions 2.0 to 9.0.2 contain a vulnerability in the Go2Meeting decoder that allows attackers to exploit uninitialized variables. This issue can potentially lead to the leakage of stack memory by leveraging out-of-range indices within a Kempf palette. By crafting a specific G2M3 or G2M4 stream with a short palette, malicious actors can manipulate the kempf_restore_buf() function, enabling the exposure of sensitive data such as pointers or stack guard values in the decoded output.

References