CVE-2026-120246

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled newpalette entries in cdxldecodeham8 or...

CVE-2026-120246

FFmpeg versions 4.4 through 9.0.2 are vulnerable to a use of uninitialized variable in the CDXL decoder . Specifically, the functions cdxl_decode_ham8() and cdxl_decode_ham6() may select unfilled new_palette entries when processing a crafted type-0 CDXL file. This flaw allows an attacker to leak ...

EUVD-2026-114743

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled newpalette entries in cdxldecodeham8 or...

CVE-2026-120246: FFmpeg: FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack…

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled newpalette entries in cdxldecodeham8 or...