CVE-2026-120246 FFmpeg CVE debrief

Who should care

Defenders responsible for media processing and decoding contexts, as well as those managing FFmpeg installations, should assess exposure and prioritize patching. This includes operators of media processing systems, platform administrators, vulnerability management teams, and security teams. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigans

Why it matters

CVE-2026-120246 is a use of uninitialized variable vulnerability in FFmpeg's CDXL decoder, which can lead to memory disclosure and potential security risks. Defenders should prioritize verifying and patching FFmpeg installations, especially in media processing and decoding contexts.

• Potential memory disclosure via crafted CDXL files
• Exposure of stack bytes and pointer fragments in BGR24 output
• Need for verification and patching of FFmpeg installations
• Potential for increased risk in media processing and decoding contexts

Technical summary

The vulnerability is caused by the use of uninitialized variable in the CDXL decoder, which leaks stack memory into decoded pixels via unfilled HAM palette entries. This can be exploited by crafting a type-0 CDXL file to expose stack bytes and pointer fragments in the BGR24 output. The vulnerability affects FFmpeg versions 4.4 through 9.0.2 and is confirmed by the CVE record and NVD entry. Additional information on exploitation and impact is limited, but defenders should prioritize verifying and patching FFmpeg installations, especially in media processing and decoding contexts.

Defensive priority

Defenders should prioritize verifying and patching FFmpeg installations, especially in media processing and decoding contexts.

Recommended defensive actions

• Verify and patch FFmpeg installations to prevent potential memory disclosure
• Review and update media processing and decoding contexts to ensure secure configurations
• Monitor for potential exploitation attempts and update threat detection rules accordingly
• Perform vulnerability scanning to identify exposed systems
• Implement compensating controls for exposed systems
• Review asset inventory to ensure accurate tracking of affected systems
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability is confirmed in FFmpeg versions 4.4 through 9.0.2. The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation and impact is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.