Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-120245— FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder

Quick assessment

Affected

FFmpeg FFmpeg

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FFmpeg 0.10 至 9.0.2 版本在函数中存在一个未初始化资源使用漏洞。当解码被截断的 1 位和 4 位调色板 Sun Raster 图像时，该漏洞会导致堆内存泄露。攻击者可构造被截断的 Sun Raster 文件，使未清除的临时位图被扩展为 PAL8 像素，从而在解码输出中暴露过时的堆内容（例如分配器元数据）。

CVSS 5.5 · Medium Updated Nov 01, 2026

Possible ATT&CK Techniques 1 AI

T1069 · Permission Groups Discovery

Affected Version Matrix 1

Vendor	Product	Version Range	Status
FFmpeg	FFmpeg	`0.10≤ 9.0.2`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder

Source: CVE Program / CVE List V5

Vulnerability Description

FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对未经初始化资源的使用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
FFmpeg	FFmpeg	0.10 ~ 9.0.2	-

II. Public POCs for CVE-2026-120245

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120245

请登录查看更多情报信息。

Other References for CVE-2026-120245 (5)

https://github.com/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180 patch
https://github.com/FFmpeg/FFmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e patch
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877 issue-tracking
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c#L188-L194 technical-description
https://www.vulncheck.com/advisories/ffmpeg-0.10-through-9.0.2-uninitialized-memory-disclosure-via-sun-raster-decoder third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120245

Same Patch Batch · FFmpeg · 2026-11-01 · 5 CVEs total

CVE-2026-120247	5.5 MEDIUM	FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure
CVE-2026-120244	5.5 MEDIUM	FFmpeg 2.1 through 9.0.2 Uninitialized Memory Leak via PCX Decoder
CVE-2026-120246	5.5 MEDIUM	FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder
CVE-2026-120243	5.5 MEDIUM	FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette

IV. Related Vulnerabilities

Same product: FFmpeg

Same vendor: FFmpeg

Same weakness: CWE-908