DEBIAN-CVE-2026-120246: Medium severity debian/ffmpeg vulnerability

Published Nov 1, 2026

Updated

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled newpalette entries in cdxldecodeham8() or cdxldecodeham6(), exposing stack bytes and pointer fragments in the BGR24 output.

Affected Software

3 affected components

debian/ffmpeg*

Event History

Nov 1, 2026

CVE Published

via OSV·01:17 AM

Data Sourced

via OSV·01:17 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker provide to trigger the issue?

An attacker must supply a crafted type-0 CDXL file. The file must contain HAM pixels that select unfilled new_palette entries during CDXL HAM decoding.

What information could be exposed?

The decoder can copy uninitialized stack memory into BGR24 decoded pixel output. This may expose stack bytes and pointer fragments, but the provided information does not indicate integrity or availability impact.

When is a system exposed?

Exposure occurs when affected FFmpeg versions decode attacker-controlled type-0 CDXL content using the CDXL decoder's HAM8 or HAM6 paths. The issue is described for FFmpeg 4.4 through 9.0.2.

DEBIAN-CVE-2026-120246: Medium severity debian/ffmpeg vulnerability

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger the issue?

What information could be exposed?

When is a system exposed?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the issue?

What information could be exposed?

When is a system exposed?