{"id":"CVE-2026-120245","kind":"vulnerability","aliases":["CVE-2026-120245"],"related":[],"title":"FFmpeg: truncated Sun Raster images leak stale heap memory into decoded output","description":"FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.","summary":"FFmpeg versions 0.10 through 9.0.2 leave a temporary bitmap uninitialized when decoding truncated 1-bit and 4-bit paletted Sun Raster images. An attacker who supplies a crafted truncated file can read leftover heap contents, such as allocator data, in the decoded output.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","package"],"not_affected_if":["no-sunraster-decoding","trusted-input-only"],"how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`\n- Look for FFmpeg builds in services that decode untrusted media, such as upload or thumbnail pipelines\n- Check whether the bundled libavcodec is the affected build, since other packages may ship their own copy","fix":"- Move FFmpeg to a version later than `9.0.2`; the sources do not name the exact fixed release","status":"open","published_at":"2026-11-01T01:17:17+00:00","first_seen_at":"2026-11-01T01:47:22+00:00","triaged_at":"2026-11-01T01:47:40+00:00","updated_at":"2026-11-01T01:47:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-01T01:47:40Z","model":"claude-haiku-5-5","output":{"fix":"- Move FFmpeg to a version later than `9.0.2`; the sources do not name the exact fixed release","reach":"internet","title":"FFmpeg: truncated Sun Raster images leak stale heap memory into decoded output","impact":"low","summary":"FFmpeg versions 0.10 through 9.0.2 leave a temporary bitmap uninitialized when decoding truncated 1-bit and 4-bit paletted Sun Raster images. An attacker who supplies a crafted truncated file can read leftover heap contents, such as allocator data, in the decoded output.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ffmpeg","media-processing","libavcodec"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Heap memory contents leak into decoded output for attacker-chosen files","analyst_note":"Confirm the fixed FFmpeg version and whether the sunrast decoder is enabled in default builds, using the NVD entry and the FFmpeg release notes.","how_to_check":"- Check the installed FFmpeg version with `ffmpeg -version`\n- Look for FFmpeg builds in services that decode untrusted media, such as upload or thumbnail pipelines\n- Check whether the bundled libavcodec is the affected build, since other packages may ship their own copy","plain_action":"","needs_analyst":true,"not_affected_if":["no-sunraster-decoding","trusted-input-only"],"who_is_affected":"Systems that decode Sun Raster (.sun, .ras) images from untrusted sources with affected FFmpeg builds are exposed. Services that only process trusted media or never decode Sun Raster files can skip it. The sources do not say whether default builds enable this decoder.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000744,"input_tokens":4189,"output_tokens":650,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120245':15A,18A '-2026':14A,17A '0.10':27B,69C '1':38B,90C '4':41B,93C '9.0.2':29B,71C 'alloc':62B,123C 'attack':48B,99C 'bit':39B,42B,91C,94C 'bitmap':33B,111C 'contain':72C 'content':59B,120C 'craft':52B,101C 'cve':13A,16A 'data':63B 'decod':11A,36B,66B,81C,88C,126C 'expand':113C 'expos':117C 'ffmpeg':1A,19B,25B,68C 'file':54B,106C 'frame':82C 'heap':8A,58B,85C,119C 'imag':5A,46B,98C 'leak':6A,84C 'leav':30B 'leftov':57B 'libavcodec':20B 'media':22B 'media-process':21B 'memori':9A,86C 'output':12A,67B,127C 'packag':24B 'pal8':115C 'palet':43B,95C 'pixel':116C 'process':23B 'raster':4A,45B,97C,105C 'read':56B 'resourc':77C 'stale':7A,118C 'sun':3A,44B,96C,104C 'sunrast':80C 'suppli':50B 'temporari':32B,110C 'truncat':2A,37B,53B,89C,103C 'unclear':109C 'uniniti':34B,76C 'use':74C 'version':26B 'vulner':78C 'word':124C","nicknames":[],"mitigations":[],"who_affected":"Systems that decode Sun Raster (.sun, .ras) images from untrusted sources with affected FFmpeg builds are exposed. Services that only process trusted media or never decode Sun Raster files can skip it. The sources do not say whether default builds enable this decoder.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T01:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120245","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120245","severity":null,"published_at":"2026-11-01T01:17:17+00:00","modified_at":"2026-11-01T01:17:17+00:00","first_seen_at":"2026-11-01T01:47:22+00:00","fetched_at":"2026-11-01T01:47:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}