CVE-2026-120246
Received Received - Intake

Use of Uninitialized Variable in FFmpeg CDXL Decoder

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: VulnCheck

Description
FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120246
EUVD
EUVD-2026-114743

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FFmpeg FFmpeg 4.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-457 The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in FFmpeg versions 4.4 through 9.0.2 involves a use of uninitialized variable in the CDXL decoder. Attackers can craft a malicious CDXL file that exploits unfilled HAM palette entries in the cdxl_decode_ham8() or cdxl_decode_ham6() functions. This causes stack memory, including pointer fragments, to leak into decoded pixel output as BGR24 data.

Detection Guidance

To detect this vulnerability, inspect FFmpeg versions between 4.4 and 9.0.2. Check for CDXL file processing in logs or network traffic. Use commands like 'ffmpeg -version' to verify the version. Monitor for crashes or memory leaks when processing CDXL files.

Impact Analysis

An attacker could exploit this to leak sensitive memory contents, such as stack variables or pointers, through video output. This may lead to information disclosure, allowing attackers to infer memory layout or extract sensitive data from the process.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by exposing uninitialized memory containing sensitive data in decoded video frames. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. Memory disclosure in media processing may lead to unauthorized access to residual data, violating confidentiality requirements.

Mitigation Strategies

Immediately upgrade FFmpeg to a patched version. If upgrading is not possible, disable CDXL file processing in FFmpeg or block CDXL files at the network perimeter. Apply the fix from commit 47313ad3f9f33b892384b976fb7c09b3c85fd74e if compiling from source.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120246. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart