PT-2026-134686
CVE-2026-120245
·
Published
2026-11-01
·
Updated
2026-11-01
Description by
CVSS 4.0
6.8
MediumMetricsAV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
FFmpeg versions 0.10 through 9.0.2
Description
A use of uninitialized resource issue exists in the
sunrast decode frame() function. This occurs when decoding truncated 1-bit and 4-bit paletted Sun Raster images, leading to heap memory leaks. An attacker can provide a specially crafted truncated Sun Raster file that causes an uncleared temporary bitmap to be expanded into PAL8 pixels, which exposes stale heap contents, such as allocator words, in the decoded output.Recommendations
Update FFmpeg to a version later than 9.0.2.
As a temporary mitigation, avoid processing untrusted Sun Raster images using the
sunrast decode frame() function.Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾