CVE-2026-120245

FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast decode frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.