Live › vulnerability › CVE-2026-120246
FFmpeg's CDXL decoder reads palette entries it never initialized when decoding HAM-encoded frames. A crafted CDXL file can make decoded output contain leftover stack bytes and pointer fragments, which can leak memory contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 01:47 UTC. All times on this page are UTC.
Systems that run FFmpeg 4.4 through 9.0.2 to decode CDXL files, especially services that accept user-uploaded media and convert it. Deployments that never decode CDXL input or only process trusted files are less exposed. The sources do not name a patched version.
No product ranges from the sources yet.
ffmpeg -version and compare against the affected range 4.4 through 9.0.2.ffmpeg -decoders | grep cdxl).No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output.
This page as .md · .json · in your agent: get_signal("CVE-2026-120246")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.