UBUNTU-CVE-2026-120246: Medium severity ubuntu/libav vulnerability
FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled newpalette entries in cdxldecodeham8() or cdxldecodeham6(), exposing stack bytes and pointer fragments in the BGR24 output.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that use the affected FFmpeg or libav packages to decode attacker-controlled CDXL files are exposed. The vulnerable paths are the CDXL HAM decoders for type-0 CDXL content.
What must an attacker do to exploit it?
An attacker must cause the target to decode a crafted type-0 CDXL file and requires user interaction according to the supplied severity vector. The file uses HAM pixels that select unfilled new_palette entries, causing stack memory to be emitted in BGR24 output.
What is the impact of successful exploitation?
The issue can disclose stack memory, including pointer fragments, through decoded pixel output. The supplied vector indicates high confidentiality impact and no integrity or availability impact.
What can be done if patching is not immediately possible?
Avoid decoding untrusted CDXL files, particularly type-0 files using HAM pixel data. Restrict access to workflows or services that accept and decode such media until an updated package can be deployed.