Uninitialized Resource Vulnerability in FFmpeg's PCX Decoder
CVE-2026-120244

6.8MEDIUM

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
1 November 2026

What is CVE-2026-120244?

The vulnerability in FFmpeg's PCX decoder involves a use of uninitialized resources, enabling attackers to exploit memory leaks. By crafting a specially-designed PCX image with truncated RLE scanlines, attackers can cause the pcx_decode_frame() function to improperly copy contents from an uninitialized av_malloc() buffer. This leads to sensitive information being exposed through the resulting decoded pixels, potentially compromising user data.

Affected Version(s)

FFmpeg 2.1 <= 9.0.2

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24868
issue-tracking
https://github.com/FFmpeg/FFmpeg/commit/ecd5dfc308a164757...
patch
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/p...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adrian Junge (vurlo)
.