Live › vulnerability › CVE-2026-120243
FFmpeg versions 2.0 through 9.0.2 read uninitialized stack memory when decoding a crafted G2M3 or G2M4 (Go2Meeting) video stream with a short palette. An attacker can get stack contents, including pointers or stack guards, copied into the decoded output.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 01:47 UTC. All times on this page are UTC.
Systems that run FFmpeg to decode video from untrusted sources, such as media-processing services, transcoding pipelines or upload handlers that accept arbitrary files. Local use on trusted files carries little risk. unknown whether the sources name specific packages or builds affected beyond the version range.
No product ranges from the sources yet.
ffmpeg -version and compare against the affected range 2.0 through 9.0.2.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.
This page as .md · .json · in your agent: get_signal("CVE-2026-120243")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.