{"id":"CVE-2026-120243","kind":"vulnerability","aliases":["CVE-2026-120243"],"related":[],"title":"FFmpeg: crafted Go2Meeting video stream leaks stack memory into output","description":"FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.","summary":"FFmpeg versions 2.0 through 9.0.2 read uninitialized stack memory when decoding a crafted G2M3 or G2M4 (Go2Meeting) video stream with a short palette. An attacker can get stack contents, including pointers or stack guards, copied into the decoded output.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","runtime","self-hosted"],"not_affected_if":["trusted-input-only","versions-outside-range"],"how_to_check":"- Run `ffmpeg -version` and compare against the affected range `2.0` through `9.0.2`.\n- Check whether your pipeline decodes untrusted Go2Meeting (G2M) video files.","fix":null,"status":"open","published_at":"2026-11-01T01:17:17+00:00","first_seen_at":"2026-11-01T01:47:20+00:00","triaged_at":"2026-11-01T01:47:43+00:00","updated_at":"2026-11-01T01:47:43+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-01T01:47:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted Go2Meeting video stream leaks stack memory into output","impact":"low","summary":"FFmpeg versions 2.0 through 9.0.2 read uninitialized stack memory when decoding a crafted G2M3 or G2M4 (Go2Meeting) video stream with a short palette. An attacker can get stack contents, including pointers or stack guards, copied into the decoded output.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","media-processing","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Stack memory contents leak into decoded output, possibly exposing pointers.","analyst_note":"Confirm the fixed FFmpeg version and whether the flaw is reachable through default decoding paths, using the NVD entry and the FFmpeg project release notes.","how_to_check":"- Run `ffmpeg -version` and compare against the affected range `2.0` through `9.0.2`.\n- Check whether your pipeline decodes untrusted Go2Meeting (G2M) video files.","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-input-only","versions-outside-range"],"who_is_affected":"Systems that run FFmpeg to decode video from untrusted sources, such as media-processing services, transcoding pipelines or upload handlers that accept arbitrary files. Local use on trusted files carries little risk. unknown whether the sources name specific packages or builds affected beyond the version range.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000714,"input_tokens":4179,"output_tokens":592,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120243':13A,16A '-2026':12A,15A '2.0':27B,65C '9.0.2':29B,67C 'allow':80C 'attack':49B,81C,93C 'buf':107C 'byte':111C 'contain':68C 'content':53B 'copi':59B,108C 'craft':2A,37B,95C 'cve':11A,14A 'decod':35B,62B,78C,118C 'ffmpeg':1A,17B,25B,64C 'g2m3':38B 'g2m3/g2m4':97C 'g2m4':40B 'get':51B 'go2meeting':3A,41B,77C 'guard':58B,116C 'host':24B 'includ':54B,112C 'indic':92C 'kempf':102C,105C 'leak':6A,83C 'media':19B 'media-process':18B 'memori':8A,33B,85C 'out-of-rang':87C 'output':10A,63B,119C 'palett':47B,91C,103C 'pointer':55B,113C 'process':20B 'rang':90C 'read':30B 'restor':106C 'runtim':21B 'self':23B 'self-host':22B 'short':46B,101C 'stack':7A,32B,52B,57B,84C,110C,115C 'stream':5A,43B,98C 'uniniti':31B,72C,109C 'use':70C 'variabl':73C 'version':26B 'video':4A,42B 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg to decode video from untrusted sources, such as media-processing services, transcoding pipelines or upload handlers that accept arbitrary files. Local use on trusted files carries little risk. unknown whether the sources name specific packages or builds affected beyond the version range.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T01:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120243","severity":null,"published_at":"2026-11-01T01:17:17+00:00","modified_at":"2026-11-01T01:17:17+00:00","first_seen_at":"2026-11-01T01:47:20+00:00","fetched_at":"2026-11-01T01:47:20+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}