CVE-2026-120247 FFmpeg CVE debrief

Who should care

Defenders responsible for FFmpeg installations, particularly those using versions 2.3 through 9.0.2, should assess exposure and prioritize patching to prevent potential heap memory exposure.

Why it matters

Defenders should prioritize verifying and patching FFmpeg installations to prevent potential heap memory exposure due to the use of uninitialized resource vulnerability in the Huffyuv decoder.

• Potential exposure of heap memory contents via decoded pixels
• Requires verification of FFmpeg versions and patching to prevent exploitation
• Monitoring of FFmpeg installations for potential exploitation attempts is necessary

Technical summary

FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents. This vulnerability allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Defenders should prioritize verifying and patching FFmpeg installations to prevent potential heap memory exposure. The vulnerability has a CVSS score of 6.8 and is classified as MEDIUM severity.

Defensive priority

Defenders should prioritize verifying and patching FFmpeg installations to prevent potential heap memory exposure.

Recommended defensive actions

• Verify and apply FFmpeg patches to address the use of uninitialized resource vulnerability
• Review and update inventory of FFmpeg installations to ensure all instances are patched
• Monitor FFmpeg installations for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the use of uninitialized resource vulnerability in the Huffyuv decoder of FFmpeg, allowing attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.