{"id":"CVE-2026-120245","summary":"FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder","details":"FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.","modified":"2026-11-04T07:05:52.828572674Z","published":"2026-11-01T00:57:10.732Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-908"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120245.json"},"references":[{"type":"WEB","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120245.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120245"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/ffmpeg-0.10-through-9.0.2-uninitialized-memory-disclosure-via-sun-raster-decoder"},{"type":"REPORT","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877"},{"type":"FIX","url":"https://github.com/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180"},{"type":"FIX","url":"https://github.com/FFmpeg/FFmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e"},{"type":"PACKAGE","url":"https://github.com/FFmpeg/FFmpeg"},{"type":"ARTICLE","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c#L188-L194"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ffmpeg/ffmpeg","events":[{"introduced":"7e16636995fd6710164f7622cd77abc94c27a064"},{"fixed":"356a391bf57df2fb80fd61f2821c8c83d15ce180"},{"fixed":"66b6ca270b33fd74367d7d371f6de16ec664446e"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0.10"},{"last_affected":"9.0.2"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"356a391bf57df2fb80fd61f2821c8c83d15ce180"}]},{"range":[{"fixed":"66b6ca270b33fd74367d7d371f6de16ec664446e"}],"source":"REFERENCES_COMMIT"}]}}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-120245.json","vanir_signatures":[{"digest":{"function_hash":"121470427011164342612608011699446206092","length":4630},"id":"CVE-2026-120245-043a02e4","signature_type":"Function","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e","target":{"function":"sunrast_decode_frame","file":"libavcodec/sunrast.c"},"deprecated":false},{"target":{"function":"sunrast_decode_frame","file":"libavcodec/sunrast.c"},"deprecated":false,"digest":{"length":4545,"function_hash":"328793432942033240126915758432038478511"},"id":"CVE-2026-120245-3aa882b1","signature_type":"Function","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180"},{"signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e","target":{"file":"libavcodec/sunrast.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["166369974505262071564745363441525925674","23542308132307762622473131827896728892","60410882598173876592570086028770238937","58849366844802024588278991932528340675"]},"id":"CVE-2026-120245-4f3ef133","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180","target":{"file":"libavcodec/sunrast.c"},"deprecated":false,"digest":{"line_hashes":["246269444886429893015897389355958034129","304952796253546213102364914153693260885","310401897510975981440197836847745169173","21410812048475526412792555540459829575","181641337434402783557361870286873312882","74268594821454964174588969379062164958","13021296171988844990666979756138275800","126661860181536018137405445997730864014","176471363118472221402200029027153348113","242661633336906948578110701580854977454","38978271272902867048067177499341841200"],"threshold":0.9},"id":"CVE-2026-120245-68711f34"}],"vanir_signatures_modified":"2026-11-04T07:05:52Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}