CVE-2026-120247

FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decodeslice t...

CVE-2026-120247

FFmpeg versions 2.3 through 9.0.2 are vulnerable to a use of uninitialized resource (CWE-908) within the Huffyuv decoder . An attacker can craft a Huffyuv BGR24/BGRA video with short packed-BGR bitstreams where entropy data ends prematurely. This causes the decode_slice() function to include unin...

CVE-2026-120247 FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure

FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decodeslice t...