{"id":"CVE-2026-120247","kind":"vulnerability","aliases":["CVE-2026-120247"],"related":[],"title":"FFmpeg: crafted Huffyuv video leaks heap memory into decoded frames","description":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents.","summary":"FFmpeg's Huffyuv decoder can be fed a short packed-BGR bitstream that makes it copy uninitialized heap bytes into output video frames. An attacker who supplies a crafted video can read heap memory contents through the decoded pixels.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","media-processing","package"],"not_affected_if":["huffyuv-not-used","untrusted-input-not-decoded"],"how_to_check":"- Run `ffmpeg -version` and compare against the affected range 2.3 through 9.0.2.\n- Check whether your application or service decodes untrusted Huffyuv video files.","fix":null,"status":"open","published_at":"2026-11-01T01:17:18+00:00","first_seen_at":"2026-11-01T01:47:22+00:00","triaged_at":"2026-11-01T01:47:38+00:00","updated_at":"2026-11-01T01:47:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-01T01:47:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted Huffyuv video leaks heap memory into decoded frames","impact":"low","summary":"FFmpeg's Huffyuv decoder can be fed a short packed-BGR bitstream that makes it copy uninitialized heap bytes into output video frames. An attacker who supplies a crafted video can read heap memory contents through the decoded pixels.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"heap memory contents leak into decoded video output","analyst_note":"Check the NVD entry and FFmpeg's security advisories for a fixed version and whether the flaw is reachable through default decoding paths.","how_to_check":"- Run `ffmpeg -version` and compare against the affected range 2.3 through 9.0.2.\n- Check whether your application or service decodes untrusted Huffyuv video files.","plain_action":"","needs_analyst":true,"not_affected_if":["untrusted-input-not-decoded","huffyuv-not-used"],"who_is_affected":"Systems that decode untrusted video files with FFmpeg's Huffyuv decoder are the ones exposed, since the attacker supplies the file. Services that only process their own trusted media, or that do not use FFmpeg for decoding, are unlikely to be affected. The sources do not say which products bundle the affected versions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000699,"input_tokens":4192,"output_tokens":559,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120247':13A,16A '-2026':12A,15A '0':113C '2.3':63C '9.0.2':65C 'add':109C 'allow':78C 'attack':47B,79C,93C 'bgr':33B,91C 'bgr24/bgra':98C 'bitstream':34B,92C 'byte':41B,114C 'caus':105C 'contain':66C 'content':57B,120C 'copi':38B 'craft':2A,51B,95C 'cve':11A,14A 'data':102C 'decod':9A,25B,60B,76C,85C,106C 'earli':104C 'end':103C 'entropi':101C 'expos':118C 'fed':28B 'ffmpeg':1A,17B,22B,62C 'frame':10A,45B,117C 'heap':6A,40B,55B,82C,119C 'huffyuv':3A,24B,75C,97C 'leak':5A,81C 'make':36B 'media':19B 'media-process':18B 'memori':7A,56B,83C 'output':43B,116C 'pack':32B,90C 'packag':21B 'packed-bgr':31B,89C 'pixel':61B,86C 'process':20B 'read':54B 'resourc':71C 'short':30B,88C 'slice':107C 'suppli':49B 'temp':112C 'uniniti':39B,70C,110C 'use':68C 'via':87C 'video':4A,44B,52B,99C 'vulner':72C 'whose':100C","nicknames":[],"mitigations":[],"who_affected":"Systems that decode untrusted video files with FFmpeg's Huffyuv decoder are the ones exposed, since the attacker supplies the file. Services that only process their own trusted media, or that do not use FFmpeg for decoding, are unlikely to be affected. The sources do not say which products bundle the affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T01:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120247","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120247","severity":null,"published_at":"2026-11-01T01:17:18+00:00","modified_at":"2026-11-01T01:17:18+00:00","first_seen_at":"2026-11-01T01:47:22+00:00","fetched_at":"2026-11-01T01:47:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}