Uninitialized Resource Vulnerability in FFmpeg's Huffyuv Decoder
CVE-2026-120247

6.8MEDIUM

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
1 November 2026

What is CVE-2026-120247?

FFmpeg versions 2.3 to 9.0.2 exhibit a use of uninitialized resource vulnerability within the Huffyuv decoder. This flaw allows attackers to craft specifically designed Huffyuv BGR24/BGRA videos, which contain improperly formatted entropy data. As a result, the decode_slice() function may inadvertently introduce uninitialized data into output frames. This can lead to the exposure of sensitive heap memory contents, posing a significant risk to system integrity and data confidentiality.

Affected Version(s)

FFmpeg 2.3 <= 9.0.2

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24869
issue-tracking
https://github.com/FFmpeg/FFmpeg/commit/7c73707355708c846...
patch
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/h...
technical-description

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adrian Junge (vurlo)
.