CVE-2026-120244: FFmpeg 2.1 through 9.0.2 Uninitialized Memory Leak via PCX Decoder

Q: What must an attacker do to trigger the memory disclosure?

They must induce processing of a crafted PCX image with truncated RLE scanline data. Exploitation requires user interaction and is local according to the supplied vector.

Q: What information can be exposed?

The decoder can copy uninitialized contents from an av_malloc() heap buffer into visible decoded pixels. The reported impact is confidentiality loss; integrity and availability impacts are not indicated.

Q: Which deployments should be prioritized for remediation?

Prioritize systems that decode PCX images using affected FFmpeg versions, including the listed Ubuntu and Debian FFmpeg packages and Ubuntu libav. The affected upstream range is FFmpeg 2.1 through 9.0.2.

Published Nov 1, 2026

Updated

FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcxdecodeframe() to copy uninitialized avmalloc() buffer contents into visible decoded pixels.

Affected Software

12 affected components

debian/ffmpeg<=7:5.1.9-0+deb12u1, <=7:7.1.5-0+deb13u1, <=7:9.0.2-4

debian/ffmpeg*

ubuntu/libav*

ubuntu/ffmpeg*

Event History

Nov 1, 2026

CVE Published

via MITRE·12:57 AM

Data Sourced

via MITRE·12:57 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 AM

DescriptionSeverityWeakness

Data Sourced

via OSV·01:17 AM

Affected Software

Frequently Asked Questions

What must an attacker do to trigger the memory disclosure?

They must induce processing of a crafted PCX image with truncated RLE scanline data. Exploitation requires user interaction and is local according to the supplied vector.

What information can be exposed?

The decoder can copy uninitialized contents from an av_malloc() heap buffer into visible decoded pixels. The reported impact is confidentiality loss; integrity and availability impacts are not indicated.

Which deployments should be prioritized for remediation?

Prioritize systems that decode PCX images using affected FFmpeg versions, including the listed Ubuntu and Debian FFmpeg packages and Ubuntu libav. The affected upstream range is FFmpeg 2.1 through 9.0.2.

CVE-2026-120244: FFmpeg 2.1 through 9.0.2 Uninitialized Memory Leak via PCX Decoder

Affected Software

Event History

Frequently Asked Questions

What must an attacker do to trigger the memory disclosure?

What information can be exposed?

Which deployments should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to trigger the memory disclosure?

What information can be exposed?

Which deployments should be prioritized for remediation?