PT-2026-134684
CVE-2026-120243
·
Published
2026-11-01
·
Updated
2026-11-01
Description by
CVSS 3.1
5.5
MediumMetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf restore buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.
Found an issue in the description? Have something to add? Feel free to write us 👾