CVE-2026-120245

EUVD-2026-114742
FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 2.09%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
ffmpegffmpeg
0.10 ≤
𝑥
≤ 9.0.2
CNA
Debian logo
Debian Releases
Debian Product
Codename
ffmpeg
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
trixie (security)
vulnerable
Common Weakness Enumeration
References
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877
https://github.com/FFmpeg/FFmpeg
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c#L188-L194
https://github.com/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180
https://github.com/FFmpeg/FFmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e
https://www.vulncheck.com/advisories/ffmpeg-0.10-through-9.0.2-uninitialized-memory-disclosure-via-sun-raster-decoder