CVE-2026-120246

Name of the Vulnerable Software and Affected Versions FFmpeg versions 4.4 through 9.0.2

Description The CDXL decoder contains an issue where uninitialized variables lead to stack memory leakage into decoded pixels through unfilled HAM palette entries. A remote attacker can use a specially crafted type-0 CDXL file to trigger this behavior via the cdxl decode ham8() or cdxl decode ham6() functions, resulting in the exposure of stack bytes and pointer fragments within the BGR24 output.

Recommendations Update FFmpeg to a version newer than 9.0.2.