DEBIAN-CVE-2026-120247: Medium severity debian/ffmpeg vulnerability

Published Nov 1, 2026

Updated

FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decodeslice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents.

Affected Software

3 affected components

debian/ffmpeg*

Event History

Nov 1, 2026

CVE Published

via OSV·01:17 AM

Data Sourced

via OSV·01:17 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What input conditions are required to trigger the issue?

The input must be a crafted Huffyuv video using packed BGR24 or BGRA data whose entropy data terminates early. The vulnerable behavior occurs in the Huffyuv decoder's decode_slice() handling.

What access does an attacker need?

The supplied CVSS vector indicates local attack access and required user interaction. An attacker would need to get a user or local workflow to decode the crafted video.

What is the likely security impact?

Uninitialized heap bytes can be incorporated into decoded output pixels, potentially exposing heap-resident data. The supplied vector rates confidentiality impact as high, with no integrity or availability impact.

DEBIAN-CVE-2026-120247: Medium severity debian/ffmpeg vulnerability

Affected Software

Event History

Frequently Asked Questions

What input conditions are required to trigger the issue?

What access does an attacker need?

What is the likely security impact?

Company

Resources

Contact

Frequently Asked Questions

What input conditions are required to trigger the issue?

What access does an attacker need?

What is the likely security impact?