Use of Uninitialized Variable in CDXL Decoder of FFmpeg by FFmpeg

CVE-2026-120246

What is CVE-2026-120246?

An uninitialized variable vulnerability exists in the CDXL decoder of FFmpeg, affecting versions from 4.4 to 9.0.2. This flaw allows attackers to exploit crafted type-0 CDXL files, leaking sensitive stack memory into the decoded pixel output. Specifically, the vulnerability manifests in the handling of HAM palette entries during the decoding process, leading to the exposure of stack byte data via unfilled new_palette entries. Users of affected FFmpeg versions are encouraged to update to address this issue.

References