Uninitialized Resource Exposure in FFmpeg's Sun Raster Image Decoder

CVE-2026-120245

What is CVE-2026-120245?

FFmpeg versions 0.10 through 9.0.2 are susceptible to a vulnerability within the sunrast_decode_frame() function, which allows attackers to exploit uninitialized memory. Specifically, when dealing with truncated Sun Raster images, this vulnerability can result in the leakage of heap memory. Crafted files may lead to the exposure of sensitive data residing in cleared temporary buffers, notably during the conversion of 1-bit and 4-bit paletted images, thereby disclosing stale data from the heap.

References