UBUNTU-CVE-2026-120244: Medium severity ubuntu/libav vulnerability
FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcxdecodeframe() to copy uninitialized avmalloc() buffer contents into visible decoded pixels.
Affected Software
Event History
Frequently Asked Questions
Which Ubuntu installations should be prioritized for review?
Prioritize systems using the Ubuntu ffmpeg or libav packages where PCX images may be processed. The affected FFmpeg range is 2.1 through 9.0.2.
What access does an attacker need to trigger the information disclosure?
The vulnerability is rated as local, requires no privileges, and requires user interaction. Exploitation relies on a crafted PCX image with prematurely terminated RLE scanline data being decoded.
What is the expected security impact?
Successful exploitation can expose uninitialized heap memory in decoded pixel output. The provided severity vector indicates high confidentiality impact, with no indicated integrity or availability impact.