CVE-2026-120246

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-120246
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-120246.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-120246
Downstream
CGA (2)
DEBIAN (1)
ECHO (1)
UBUNTU (1)
Published
2026-11-01T00:57:11Z
Modified
2026-11-04T07:06:16Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder
Details

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-457"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120246.json"
}
References

Affected packages

Git / github.com/ffmpeg/ffmpeg

Affected ranges

Type
GIT
Repo
https://github.com/ffmpeg/ffmpeg
Events
Introduced
c5079bf3bccd24bf8ed45ff47ff4071fd09e9fd8
Fixed
47313ad3f9f33b892384b976fb7c09b3c85fd74e
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "4.4"
                },
                {
                    "last_affected": "9.0.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "47313ad3f9f33b892384b976fb7c09b3c85fd74e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

n4.*
n4.4-dev
n4.5-dev
n5.*
n5.1-dev
n5.2-dev
n6.*
n6.1-dev
n6.2-dev
n7.*
n7.1-dev
n7.2-dev
n8.*
n8.1-dev
n8.2-dev
n9.*
n9.1-dev

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-120246.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "197035639704901340341541663136487796201",
            "length": 661
        },
        "id": "CVE-2026-120246-04140b6c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/ffmpeg/ffmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e",
        "target": {
            "file": "libavcodec/cdxl.c",
            "function": "import_palette"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "22451100307243728118509296048432078453",
            "length": 866
        },
        "id": "CVE-2026-120246-42646866",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/ffmpeg/ffmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e",
        "target": {
            "file": "libavcodec/cdxl.c",
            "function": "cdxl_decode_ham6"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "120957051427891391473704036089567980020",
            "length": 924
        },
        "id": "CVE-2026-120246-93abb429",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/ffmpeg/ffmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e",
        "target": {
            "file": "libavcodec/cdxl.c",
            "function": "cdxl_decode_ham8"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "292416849610053976081405803285465593522",
                "290304745114266119373444574038571101813",
                "307430587685904916076741500236608335501",
                "58209882625843584381091284657707636349",
                "81516803566475515412976035684442731350",
                "297814446154424593819465724106268500106",
                "60762475606720578364238987190473283519",
                "330124382328210075741419728258507974526",
                "229573865291057436894951052147719510712",
                "175970603737763715931353607833714171633",
                "177208849392266253613602461514505211696",
                "188690717451162962550630755984836759334",
                "277139470754644361523128422075086287042",
                "207840480011687805793361290203126169541",
                "81334965054508993575186552091098724434",
                "192297349860856672322473076589288961601",
                "42575111536105271546639657565302010190",
                "83323735058278260315899651565594536426",
                "271375325918264926300019271929240448191",
                "54071102025690202376543311898623760663",
                "226193320818886166610438399004819774627",
                "65331214962674833415034444653238250862",
                "95728183962470854072392443782575016024",
                "320651947441645764705808652324030393476",
                "214464163261078783430121602376276498213",
                "246583763489704373492657415915240517703",
                "229785751688686356055651527349417640811",
                "148948070084393312722265973106692051145",
                "148890678128188289179308230206425250568",
                "142718107816953321833414505835971558849",
                "308996360329157376992891443779053233009",
                "336274021556448664631711929872059425464",
                "97274609647162279689420276207469477450",
                "58310196777470719403288431636783050418",
                "78358387188293739289290670873603425000",
                "143623823119534246493327822088751134580",
                "47006723414938911480055715891166481560",
                "10033311487935807467662641951009815070",
                "226193320818886166610438399004819774627",
                "65331214962674833415034444653238250862",
                "95728183962470854072392443782575016024",
                "320651947441645764705808652324030393476",
                "214464163261078783430121602376276498213",
                "339423836080560534784978567999501041264",
                "15666571215169321165703788235704449186",
                "148948070084393312722265973106692051145",
                "148890678128188289179308230206425250568",
                "142718107816953321833414505835971558849",
                "308996360329157376992891443779053233009",
                "110523093500390491388458336888182046002",
                "249154775849898121276921096897714776503",
                "331149151182308391750438993480115570446",
                "293580878915195516190104121142919574381",
                "340130187302409397539599615924390948198",
                "288774701469620501240663607212054015795",
                "55075761558148151065984383441006613693",
                "316150002846578947413931667225582110428"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-120246-a210a19b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/ffmpeg/ffmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e",
        "target": {
            "file": "libavcodec/cdxl.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "39791413752897981984828674924955550562",
            "length": 2545
        },
        "id": "CVE-2026-120246-b649fca9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/ffmpeg/ffmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e",
        "target": {
            "file": "libavcodec/cdxl.c",
            "function": "cdxl_decode_frame"
        }
    }
]
vanir_signatures_modified 
"2026-11-04T07:06:16Z"