CVE-2026-120247
Received Received - Intake

Heap Memory Leak in FFmpeg Huffyuv Decoder

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: VulnCheck

Description
FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120247
EUVD
EUVD-2026-114744

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FFmpeg FFmpeg 2.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-908 The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in FFmpeg versions 2.3 through 9.0.2 involves a use of uninitialized heap memory in the Huffyuv decoder. Attackers can create a specially crafted Huffyuv BGR24/BGRA video with early-ending entropy data. This causes the decode_slice() function to include uninitialized bytes from the s->temp[0] buffer in output frames, leaking heap memory contents into decoded pixels.

Detection Guidance

To detect this vulnerability, inspect FFmpeg versions between 2.3 and 9.0.2. Check for uninitialized memory leaks in Huffyuv decoder output by analyzing video processing logs or using memory debugging tools like Valgrind with FFmpeg. Craft test videos with short entropy data to observe heap memory leaks in decoded frames.

Impact Analysis

This flaw could allow attackers to access sensitive heap memory contents through crafted video files. If exploited, it may lead to information disclosure, including potentially confidential data stored in memory. Systems processing untrusted media files are at higher risk of exposure.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing sensitive data through heap memory leaks in decoded video frames. Unauthorized disclosure of memory contents may lead to unintended exposure of personal or protected health information if such data is processed by FFmpeg.

Mitigation Strategies

Upgrade FFmpeg to a version beyond 9.0.2 where the vulnerability is patched. Avoid processing untrusted media files with Huffyuv codec. Implement input validation for media files to reject malformed Huffyuv streams. Monitor for unusual memory leaks during video decoding.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120247. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart