DEBIAN-CVE-2026-120243: Medium severity debian/ffmpeg vulnerability

Published Nov 1, 2026

Updated

FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempfrestorebuf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.

Affected Software

3 affected components

debian/ffmpeg*

Event History

Nov 1, 2026

CVE Published

via OSV·01:17 AM

Data Sourced

via OSV·01:17 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker provide to trigger the information disclosure?

An attacker must supply a crafted G2M3 or G2M4 stream containing a short Kempf palette. User interaction is required, and the attack is local according to the CVSS vector.

What information could be exposed?

The decoder can copy uninitialized stack bytes into decoded output. The disclosed data may include stack memory such as pointers or stack guards.

DEBIAN-CVE-2026-120243: Medium severity debian/ffmpeg vulnerability

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger the information disclosure?

What information could be exposed?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the information disclosure?

What information could be exposed?