Live › vulnerability › CVE-2026-120245
FFmpeg versions 0.10 through 9.0.2 leave a temporary bitmap uninitialized when decoding truncated 1-bit and 4-bit paletted Sun Raster images. An attacker who supplies a crafted truncated file can read leftover heap contents, such as allocator data, in the decoded output.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 01:47 UTC. All times on this page are UTC.
Systems that decode Sun Raster (.sun, .ras) images from untrusted sources with affected FFmpeg builds are exposed. Services that only process trusted media or never decode Sun Raster files can skip it. The sources do not say whether default builds enable this decoder.
No product ranges from the sources yet.
ffmpeg -version9.0.2; the sources do not name the exact fixed releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.
This page as .md · .json · in your agent: get_signal("CVE-2026-120245")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.