Live › vulnerability › CVE-2026-120247
FFmpeg's Huffyuv decoder can be fed a short packed-BGR bitstream that makes it copy uninitialized heap bytes into output video frames. An attacker who supplies a crafted video can read heap memory contents through the decoded pixels.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 01:47 UTC. All times on this page are UTC.
Systems that decode untrusted video files with FFmpeg's Huffyuv decoder are the ones exposed, since the attacker supplies the file. Services that only process their own trusted media, or that do not use FFmpeg for decoding, are unlikely to be affected. The sources do not say which products bundle the affected versions.
No product ranges from the sources yet.
ffmpeg -version and compare against the affected range 2.3 through 9.0.2.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents.
This page as .md · .json · in your agent: get_signal("CVE-2026-120247")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.