CVE-2026-120247: FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure

Q: Which systems are exposed?

Systems using FFmpeg 2.3 through 9.0.2 are affected when they decode Huffyuv video using the packed BGR24 or BGRA formats. The listed affected software includes Ubuntu and Debian FFmpeg packages and Ubuntu libav.

Q: What does an attacker need to exploit this issue?

An attacker needs to provide a crafted Huffyuv BGR24/BGRA video with entropy data that ends early and cause it to be decoded. The supplied vector indicates local attack access, no privileges required, and user interaction required.

Q: What is the security impact?

Uninitialized heap bytes can be incorporated into decoded output pixels, potentially disclosing heap-resident data. The supplied severity vector identifies high confidentiality impact and no integrity or availability impact.

Q: How can I assess whether a deployment is affected?

Check whether the deployed FFmpeg or libav version falls between 2.3 and 9.0.2 and whether the application decodes Huffyuv BGR24 or BGRA content. The provided data does not describe a reliable way to determine whether heap data has already been disclosed.

Published Nov 1, 2026

Updated

FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decodeslice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents.

Affected Software

12 affected components

debian/ffmpeg<=7:5.1.9-0+deb12u1, <=7:7.1.5-0+deb13u1, <=7:9.0.2-4

debian/ffmpeg*

ubuntu/libav*

ubuntu/ffmpeg*

Event History

Nov 1, 2026

CVE Published

via MITRE·12:57 AM

Data Sourced

via MITRE·12:57 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 AM

DescriptionSeverityWeakness

Data Sourced

via OSV·01:17 AM

Affected Software

Frequently Asked Questions

Which systems are exposed?

Systems using FFmpeg 2.3 through 9.0.2 are affected when they decode Huffyuv video using the packed BGR24 or BGRA formats. The listed affected software includes Ubuntu and Debian FFmpeg packages and Ubuntu libav.

What does an attacker need to exploit this issue?

An attacker needs to provide a crafted Huffyuv BGR24/BGRA video with entropy data that ends early and cause it to be decoded. The supplied vector indicates local attack access, no privileges required, and user interaction required.

What is the security impact?

Uninitialized heap bytes can be incorporated into decoded output pixels, potentially disclosing heap-resident data. The supplied severity vector identifies high confidentiality impact and no integrity or availability impact.

How can I assess whether a deployment is affected?

Check whether the deployed FFmpeg or libav version falls between 2.3 and 9.0.2 and whether the application decodes Huffyuv BGR24 or BGRA content. The provided data does not describe a reliable way to determine whether heap data has already been disclosed.

CVE-2026-120247: FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed?

What does an attacker need to exploit this issue?

What is the security impact?

How can I assess whether a deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed?

What does an attacker need to exploit this issue?

What is the security impact?

How can I assess whether a deployment is affected?