{"id":"CVE-2026-120244","kind":"vulnerability","aliases":["CVE-2026-120244"],"related":[],"title":"FFmpeg: truncated PCX image leaks heap memory into decoded pixels","description":"FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into visible decoded pixels.","summary":"FFmpeg's PCX decoder copies uninitialized heap memory into the output image when an RLE scanline ends early. An attacker who supplies a crafted PCX file can read leftover heap contents in the decoded picture.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","image-upload","media-processing","package"],"not_affected_if":["no-untrusted-pcx-input"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; the sources cover versions 2.1 through 9.0.2.\n- Find out whether the service decodes untrusted PCX images, for example with `ffmpeg -i upload.pcx`.","fix":null,"status":"open","published_at":"2026-11-01T01:17:17+00:00","first_seen_at":"2026-11-01T01:47:20+00:00","triaged_at":"2026-11-01T01:47:42+00:00","updated_at":"2026-11-01T01:47:42+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-01T01:47:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: truncated PCX image leaks heap memory into decoded pixels","impact":"low","summary":"FFmpeg's PCX decoder copies uninitialized heap memory into the output image when an RLE scanline ends early. An attacker who supplies a crafted PCX file can read leftover heap contents in the decoded picture.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","media-processing","image-upload"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"heap memory contents leak into decoded image output","analyst_note":"Check the NVD entry or the FFmpeg project for a fixed version and whether the flaw is reachable through a default build.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`; the sources cover versions 2.1 through 9.0.2.\n- Find out whether the service decodes untrusted PCX images, for example with `ffmpeg -i upload.pcx`.","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-pcx-input"],"who_is_affected":"Systems that run FFmpeg to decode PCX images supplied by outside users, such as upload converters or thumbnailers, are the ones to look at. Installations that never decode PCX input from untrusted sources can skip it. The sources do not name a fixed version.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":4168,"output_tokens":539,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120244':13A,16A '-2026':12A,15A '2.1':61C '9.0.2':63C 'allow':76C 'attack':44B,77C,86C 'av':104C 'buffer':106C 'caus':97C 'contain':64C 'content':55B,107C 'copi':29B,102C 'craft':48B,88C 'cve':11A,14A 'data':94C 'decod':9A,28B,58B,74C,99C,110C 'earli':42B,96C 'end':41B,95C 'ffmpeg':1A,17B,25B,60C 'file':50B 'frame':100C 'heap':6A,31B,54B,80C 'imag':4A,19B,36B,91C 'image-upload':18B 'leak':5A,79C 'leftov':53B 'malloc':105C 'media':22B 'media-process':21B 'memori':7A,32B,81C 'output':35B 'packag':24B 'pcx':3A,27B,49B,73C,90C,98C 'pictur':59B 'pixel':10A,111C 'process':23B 'read':52B 'resourc':69C 'rle':39B,84C,93C 'scanlin':40B,85C 'suppli':46B 'truncat':2A,83C 'uniniti':30B,68C,103C 'upload':20B 'use':66C 'visibl':109C 'vulner':70C 'whose':92C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg to decode PCX images supplied by outside users, such as upload converters or thumbnailers, are the ones to look at. Installations that never decode PCX input from untrusted sources can skip it. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T01:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120244","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120244","severity":null,"published_at":"2026-11-01T01:17:17+00:00","modified_at":"2026-11-01T01:17:17+00:00","first_seen_at":"2026-11-01T01:47:20+00:00","fetched_at":"2026-11-01T01:47:20+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}