DEBIAN-CVE-2026-120244: Medium severity debian/ffmpeg vulnerability

Published Nov 1, 2026

Updated

FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcxdecodeframe() to copy uninitialized avmalloc() buffer contents into visible decoded pixels.

Affected Software

3 affected components

debian/ffmpeg*

Event History

Nov 1, 2026

CVE Published

via OSV·01:17 AM

Data Sourced

via OSV·01:17 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required to exploit this issue?

An attacker must be able to supply a crafted PCX image with RLE scanline data that ends early and have it decoded by the affected PCX decoder. The vulnerability is triggered during decoding in pcx_decode_frame().

What information could be exposed?

The issue can copy uninitialized memory from an av_malloc() buffer into decoded image pixels. This can disclose heap-memory contents through the resulting visible pixels.

Is user interaction required?

Yes. The supplied severity vector indicates user interaction is required, consistent with a user or application processing an attacker-crafted PCX image.

DEBIAN-CVE-2026-120244: Medium severity debian/ffmpeg vulnerability

Affected Software

Event History

Frequently Asked Questions

What conditions are required to exploit this issue?

What information could be exposed?

Is user interaction required?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to exploit this issue?

What information could be exposed?

Is user interaction required?