CVE-2026-120243

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-120243
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-120243.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-120243
Downstream
CGA (2)
DEBIAN (1)
ECHO (1)
UBUNTU (1)
Published
2026-11-01T00:57:09Z
Modified
2026-11-04T07:05:50Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette
Details

FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-457"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120243.json"
}
References

Affected packages

Git / github.com/ffmpeg/ffmpeg

Affected ranges

Type
GIT
Repo
https://github.com/ffmpeg/ffmpeg
Events
Introduced
2b8b2ba19fe0ca6594cb09439b9ead2c328a79d8
Fixed
edad2d0dafcf44fa315eab716fd0183ce808053b
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.0"
                },
                {
                    "last_affected": "9.0.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "edad2d0dafcf44fa315eab716fd0183ce808053b"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

n2.*
n2.0
n2.1-dev
n2.2-dev
n2.3-dev
n2.4-dev
n2.5-dev
n2.6-dev
n2.7-dev
n2.8-dev
n2.9-dev
n3.*
n3.1-dev
n3.2-dev
n3.3-dev
n3.4-dev
n3.5-dev
n4.*
n4.1-dev
n4.2-dev
n4.3-dev
n4.4-dev
n4.5-dev
n5.*
n5.1-dev
n5.2-dev
n6.*
n6.1-dev
n6.2-dev
n7.*
n7.1-dev
n7.2-dev
n8.*
n8.1-dev
n8.2-dev
n9.*
n9.1-dev

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-120243.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "277565168920903986048159568946715436902",
            "length": 2908
        },
        "id": "CVE-2026-120243-0685d698",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/ffmpeg/ffmpeg/commit/edad2d0dafcf44fa315eab716fd0183ce808053b",
        "target": {
            "file": "libavcodec/g2meet.c",
            "function": "kempf_decode_tile"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "313303952158597708612771819823095048039",
            "length": 879
        },
        "id": "CVE-2026-120243-d721a5c0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/ffmpeg/ffmpeg/commit/edad2d0dafcf44fa315eab716fd0183ce808053b",
        "target": {
            "file": "libavcodec/g2meet.c",
            "function": "kempf_restore_buf"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "160638809330132786049513158946516797704",
                "248453665855218436820802928550065363906",
                "41090461966814352563360395532882129337",
                "167018126229110959845052330358267497949",
                "278506319865767285754699098173624145677",
                "9751954035493397087702163864157547616",
                "278455037816368709338451336202935266625",
                "328445132475894535928297178309880925901",
                "306038616358422600178464892725079099388",
                "53861815168492439241807527298524982334",
                "311985644659154328471671430624571691936",
                "184710527815914191262460526128836588989",
                "282016809946019814575008900375046406868",
                "17393164924260227996610058207935692244",
                "85628013457806841716702090685921057486",
                "213651570506427380132118718770585892211",
                "123777187023096636640608335531775541014",
                "115598151382465728860241363500275508062",
                "57690502616209468656586865889403695816"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-120243-ec70291b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/ffmpeg/ffmpeg/commit/edad2d0dafcf44fa315eab716fd0183ce808053b",
        "target": {
            "file": "libavcodec/g2meet.c"
        }
    }
]
vanir_signatures_modified 
"2026-11-04T07:05:50Z"