Live › vulnerability › CVE-2026-120244
FFmpeg's PCX decoder copies uninitialized heap memory into the output image when an RLE scanline ends early. An attacker who supplies a crafted PCX file can read leftover heap contents in the decoded picture.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 01:47 UTC. All times on this page are UTC.
Systems that run FFmpeg to decode PCX images supplied by outside users, such as upload converters or thumbnailers, are the ones to look at. Installations that never decode PCX input from untrusted sources can skip it. The sources do not name a fixed version.
No product ranges from the sources yet.
ffmpeg -version; the sources cover versions 2.1 through 9.0.2.ffmpeg -i upload.pcx.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into visible decoded pixels.
This page as .md · .json · in your agent: get_signal("CVE-2026-120244")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.