UBUNTU-CVE-2026-120245: Medium severity ubuntu/libav vulnerability
FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrastdecodeframe() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.
Affected Software
Event History
Frequently Asked Questions
Which inputs trigger the issue?
The issue is triggered when decoding a truncated 1-bit or 4-bit paletted Sun Raster image. The affected decoding path is sunrast_decode_frame().
What does an attacker need to do to exploit it?
An attacker must provide a specially crafted truncated Sun Raster file and have it decoded by affected software. The vulnerability has a local attack vector and requires user interaction.
What is the potential impact?
Decoded output may expose stale heap memory because an uncleared temporary bitmap can be expanded into PAL8 pixels. Exposed data may include heap contents such as allocator words; the listed impact is confidentiality only.
Which versions are identified as affected?
FFmpeg versions 0.10 through 9.0.2 are identified as containing the issue. The listed Ubuntu software packages are ffmpeg and libav.