{"id":"CVE-2026-120247","summary":"FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure","details":"FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s-\u003etemp[0] bytes into output frames, exposing heap contents.","modified":"2026-11-04T07:05:50.739227641Z","published":"2026-11-01T00:57:12.137Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-908"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120247.json"},"references":[{"type":"WEB","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120247.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120247"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/ffmpeg-2.3-through-9.0.2-huffyuv-decoder-uninitialized-heap-memory-disclosure"},{"type":"REPORT","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24869"},{"type":"FIX","url":"https://github.com/FFmpeg/FFmpeg/commit/7c73707355708c846f718cca90096bc1a33c8989"},{"type":"PACKAGE","url":"https://github.com/FFmpeg/FFmpeg"},{"type":"ARTICLE","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/huffyuvdec.c#L802"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ffmpeg/ffmpeg","events":[{"introduced":"3ec3f70ddb1b97fd6174ab3ca8617d8a1a6516ab"},{"fixed":"7c73707355708c846f718cca90096bc1a33c8989"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"2.3"},{"last_affected":"9.0.2"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"7c73707355708c846f718cca90096bc1a33c8989"}]}]}}],"versions":["n9.1-dev","n8.2-dev","n8.1-dev","n7.2-dev","n7.1-dev","n6.2-dev","n6.1-dev","n5.2-dev","n5.1-dev","n4.5-dev","n4.4-dev","n4.3-dev","n4.2-dev","n4.1-dev","n3.5-dev","n3.4-dev","n3.3-dev","n3.2-dev","n3.1-dev","n2.9-dev","n2.8-dev","n2.7-dev","n2.6-dev","n2.5-dev","n2.4-dev","n2.3-dev"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-120247.json","vanir_signatures":[{"target":{"file":"libavcodec/huffyuvdec.c","function":"decode_bgr_1"},"deprecated":false,"digest":{"function_hash":"332489654689274654641774548177416197971","length":2051},"id":"CVE-2026-120247-2e4fb929","signature_type":"Function","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/7c73707355708c846f718cca90096bc1a33c8989"},{"deprecated":false,"digest":{"function_hash":"337710279139392245428678890190871328675","length":2360},"id":"CVE-2026-120247-a2950228","signature_type":"Function","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/7c73707355708c846f718cca90096bc1a33c8989","target":{"file":"libavcodec/huffyuvdec.c","function":"decode_plane_bitstream"}},{"target":{"file":"libavcodec/huffyuvdec.c"},"deprecated":false,"digest":{"line_hashes":["246124958578975567140026405751469059217","88666402009277409686206267389959645840","110183572143389694484634837787856684168","39130928102068324510441978312968325880","151261718338486706362231583033097560366","312868891013603950232501437088811189417","295137114391504089515018675642517607570","80262785199644013748252000955575032980","50897756805178067730859001372391933010","189288108816640039897628512191732728630","49135997035215881748108583489747220392","106797815532387025773156295742883952923","260376667315998339903250566823608735459","28474064390371241892782856392491265052","326377940604263333321429046212656857481","213445769774528439287854631163672561238","83712288552666989605557351792373913655","23896908444203129741592742301721365666","95730824479310877196554532695680831402","147187001208560514174407022968433982594","117013043819244182043076303917709665084","313674175250437697047793984042090728965","290599155828499049978459139433591969197","313105664353177041758876549622159508865","228675245368411129494010668974760295201","175804769037330154093918426155136574819","115849302903216931614787191482889875544","275850730537794199189742190759002704378","193461675831458286366228446674996684077","300458708847578075210952934458908202346"],"threshold":0.9},"id":"CVE-2026-120247-e847178f","signature_type":"Line","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/7c73707355708c846f718cca90096bc1a33c8989"}],"vanir_signatures_modified":"2026-11-04T07:05:50Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}