CVE-2026-120243
Received Received - Intake

Use of Uninitialized Variable in FFmpeg Go2Meeting Decoder

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: VulnCheck

Description
FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120243
EUVD
EUVD-2026-114740

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FFmpeg FFmpeg 2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-457 The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects FFmpeg versions 2.0 through 9.0.2. It involves a use of uninitialized variable in the Go2Meeting decoder. Attackers can craft malicious G2M3 or G2M4 streams with a short Kempf palette, causing the function kempf_restore_buf() to copy uninitialized stack memory into decoded output. This may leak sensitive data like pointers or stack guards.

Detection Guidance

Detecting this vulnerability requires analyzing FFmpeg versions and processing Go2Meeting streams. Check FFmpeg version with 'ffmpeg -version' and look for versions 2.0 through 9.0.2. Monitor network traffic for G2M3/G2M4 streams using tools like Wireshark with custom dissectors for Go2Meeting protocols.

Impact Analysis

The vulnerability allows attackers to leak stack memory, potentially exposing sensitive information such as internal pointers or stack guards. While it does not directly allow code execution or data modification, the leaked information could be used in further attacks to bypass security mechanisms or gain unauthorized access.

Compliance Impact

This vulnerability could lead to information disclosure, which may violate data protection requirements under GDPR or HIPAA if sensitive personal or health data is exposed. Organizations processing such data must ensure systems are patched to prevent unauthorized memory leaks that could compromise confidentiality.

Mitigation Strategies

Immediately update FFmpeg to a patched version beyond 9.0.2. Disable Go2Meeting decoder support if not required. Inspect and validate all multimedia files, especially G2M3/G2M4 streams, before processing. Monitor systems for unusual memory leaks or crashes in FFmpeg processes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120243. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart