{"id":"CVE-2026-120246","summary":"FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder","details":"FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output.","modified":"2026-11-04T07:06:16.221960296Z","published":"2026-11-01T00:57:11.435Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120246.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-457"]},"references":[{"type":"WEB","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120246.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120246"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/ffmpeg-4.4-through-9.0.2-uninitialized-memory-disclosure-via-cdxl-ham-decoder"},{"type":"REPORT","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24856"},{"type":"FIX","url":"https://github.com/FFmpeg/FFmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e"},{"type":"PACKAGE","url":"https://github.com/FFmpeg/FFmpeg"},{"type":"ARTICLE","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cdxl.c#L226-L229"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ffmpeg/ffmpeg","events":[{"introduced":"c5079bf3bccd24bf8ed45ff47ff4071fd09e9fd8"},{"fixed":"47313ad3f9f33b892384b976fb7c09b3c85fd74e"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"4.4"},{"last_affected":"9.0.2"}]},{"range":[{"fixed":"47313ad3f9f33b892384b976fb7c09b3c85fd74e"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["n9.1-dev","n8.2-dev","n8.1-dev","n7.2-dev","n7.1-dev","n6.2-dev","n6.1-dev","n5.2-dev","n5.1-dev","n4.5-dev","n4.4-dev"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-120246.json","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e","target":{"function":"import_palette","file":"libavcodec/cdxl.c"},"deprecated":false,"digest":{"function_hash":"197035639704901340341541663136487796201","length":661},"id":"CVE-2026-120246-04140b6c","signature_type":"Function"},{"digest":{"function_hash":"22451100307243728118509296048432078453","length":866},"id":"CVE-2026-120246-42646866","signature_type":"Function","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e","target":{"file":"libavcodec/cdxl.c","function":"cdxl_decode_ham6"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e","target":{"function":"cdxl_decode_ham8","file":"libavcodec/cdxl.c"},"deprecated":false,"digest":{"function_hash":"120957051427891391473704036089567980020","length":924},"id":"CVE-2026-120246-93abb429","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e","target":{"file":"libavcodec/cdxl.c"},"deprecated":false,"digest":{"line_hashes":["292416849610053976081405803285465593522","290304745114266119373444574038571101813","307430587685904916076741500236608335501","58209882625843584381091284657707636349","81516803566475515412976035684442731350","297814446154424593819465724106268500106","60762475606720578364238987190473283519","330124382328210075741419728258507974526","229573865291057436894951052147719510712","175970603737763715931353607833714171633","177208849392266253613602461514505211696","188690717451162962550630755984836759334","277139470754644361523128422075086287042","207840480011687805793361290203126169541","81334965054508993575186552091098724434","192297349860856672322473076589288961601","42575111536105271546639657565302010190","83323735058278260315899651565594536426","271375325918264926300019271929240448191","54071102025690202376543311898623760663","226193320818886166610438399004819774627","65331214962674833415034444653238250862","95728183962470854072392443782575016024","320651947441645764705808652324030393476","214464163261078783430121602376276498213","246583763489704373492657415915240517703","229785751688686356055651527349417640811","148948070084393312722265973106692051145","148890678128188289179308230206425250568","142718107816953321833414505835971558849","308996360329157376992891443779053233009","336274021556448664631711929872059425464","97274609647162279689420276207469477450","58310196777470719403288431636783050418","78358387188293739289290670873603425000","143623823119534246493327822088751134580","47006723414938911480055715891166481560","10033311487935807467662641951009815070","226193320818886166610438399004819774627","65331214962674833415034444653238250862","95728183962470854072392443782575016024","320651947441645764705808652324030393476","214464163261078783430121602376276498213","339423836080560534784978567999501041264","15666571215169321165703788235704449186","148948070084393312722265973106692051145","148890678128188289179308230206425250568","142718107816953321833414505835971558849","308996360329157376992891443779053233009","110523093500390491388458336888182046002","249154775849898121276921096897714776503","331149151182308391750438993480115570446","293580878915195516190104121142919574381","340130187302409397539599615924390948198","288774701469620501240663607212054015795","55075761558148151065984383441006613693","316150002846578947413931667225582110428"],"threshold":0.9},"id":"CVE-2026-120246-a210a19b"},{"signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e","target":{"file":"libavcodec/cdxl.c","function":"cdxl_decode_frame"},"deprecated":false,"digest":{"function_hash":"39791413752897981984828674924955550562","length":2545},"id":"CVE-2026-120246-b649fca9","signature_type":"Function"}],"vanir_signatures_modified":"2026-11-04T07:06:16Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}