CVE-2026-120244 FFmpeg CVE debrief

Who should care

Defenders responsible for systems using FFmpeg for PCX image processing should assess exposure and potential vulnerabilities. They should verify FFmpeg versions in use, check for exposure to PCX image processing, and consider updating FFmpeg to a version outside the affected range if possible. Additionally, defenders should review compensating controls for exposed systems, check relevant monitoring and logs, and track exceptions and remediated assets.

Why it matters

CVE-2026-120244 is a use of uninitialized resource vulnerability in FFmpeg's PCX decoder. Defenders should verify exposure in systems using affected FFmpeg versions, especially those handling PCX images, to assess potential heap memory leak vulnerabilities.

• Potential heap memory leak through crafted PCX images
• Verification of FFmpeg versions and exposure to PCX image processing is necessary
• Defenders should check for systems handling PCX images and prioritize verification

Technical summary

FFmpeg versions 2.1 through 9.0.2 contain a use of uninitialized resource vulnerability in the PCX decoder. Attackers can craft a PCX image to leak heap memory through truncated RLE scanlines. The vulnerability is related to the pcx_decode_frame() function, which copies uninitialized av_malloc() buffer contents into visible decoded pixels. Defenders should prioritize verifying exposure in systems using FFmpeg versions 2.1 through 9.0.2, especially those handling PCX images. The CVE Program and NVD provide official records and assessments of the vulnerability.

Defensive priority

Defenders should prioritize verifying exposure in systems using FFmpeg versions 2.1 through 9.0.2, especially those handling PCX images.

Recommended defensive actions

• Verify FFmpeg versions in use and check for exposure to PCX image processing
• Assess systems handling PCX images for potential heap memory leak vulnerabilities
• Consider updating FFmpeg to a version outside the affected range if possible
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry indicate a use of uninitialized resource vulnerability in FFmpeg's PCX decoder. Details are limited, and specific version remediation is not provided in the source corpus. The vulnerability allows attackers to craft a PCX image to leak heap memory through truncated RLE scanlines. Defenders should verify exposure in systems using FFmpeg versions 2.1 through 9.0.2, especially those handling PCX images. The NVD entry provides additional information on the vulnerability and its potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.