UBUNTU-CVE-2026-120247: Medium severity ubuntu/libav vulnerability
FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decodeslice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents.
Affected Software
Event History
Frequently Asked Questions
What access and interaction does exploitation require?
The CVSS vector indicates local attack access, no privileges required, and user interaction required. Exploitation involves getting a crafted Huffyuv BGR24 or BGRA video decoded.
What types of systems or workflows are exposed?
Systems using Ubuntu FFmpeg or libav are relevant when they decode Huffyuv video using the packed-BGR formats BGR24 or BGRA. The affected FFmpeg range is 2.3 through 9.0.2.
What is the potential impact if exploitation succeeds?
Decoded output pixels can contain uninitialized heap memory from the decoding process. This can disclose heap contents, with confidentiality impact rated High and no integrity or availability impact listed.