CVE-2026-120247

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-120247
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-120247.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-120247
Downstream
CGA (2)
DEBIAN (1)
ECHO (1)
UBUNTU (1)
Published
2026-11-01T00:57:12Z
Modified
2026-11-04T07:05:50Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure
Details

FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-908"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120247.json"
}
References

Affected packages

Git / github.com/ffmpeg/ffmpeg

Affected ranges

Type
GIT
Repo
https://github.com/ffmpeg/ffmpeg
Events
Introduced
3ec3f70ddb1b97fd6174ab3ca8617d8a1a6516ab
Fixed
7c73707355708c846f718cca90096bc1a33c8989
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.3"
                },
                {
                    "last_affected": "9.0.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "7c73707355708c846f718cca90096bc1a33c8989"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

n2.*
n2.3-dev
n2.4-dev
n2.5-dev
n2.6-dev
n2.7-dev
n2.8-dev
n2.9-dev
n3.*
n3.1-dev
n3.2-dev
n3.3-dev
n3.4-dev
n3.5-dev
n4.*
n4.1-dev
n4.2-dev
n4.3-dev
n4.4-dev
n4.5-dev
n5.*
n5.1-dev
n5.2-dev
n6.*
n6.1-dev
n6.2-dev
n7.*
n7.1-dev
n7.2-dev
n8.*
n8.1-dev
n8.2-dev
n9.*
n9.1-dev

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-120247.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "332489654689274654641774548177416197971",
            "length": 2051
        },
        "id": "CVE-2026-120247-2e4fb929",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/ffmpeg/ffmpeg/commit/7c73707355708c846f718cca90096bc1a33c8989",
        "target": {
            "file": "libavcodec/huffyuvdec.c",
            "function": "decode_bgr_1"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "337710279139392245428678890190871328675",
            "length": 2360
        },
        "id": "CVE-2026-120247-a2950228",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/ffmpeg/ffmpeg/commit/7c73707355708c846f718cca90096bc1a33c8989",
        "target": {
            "file": "libavcodec/huffyuvdec.c",
            "function": "decode_plane_bitstream"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "246124958578975567140026405751469059217",
                "88666402009277409686206267389959645840",
                "110183572143389694484634837787856684168",
                "39130928102068324510441978312968325880",
                "151261718338486706362231583033097560366",
                "312868891013603950232501437088811189417",
                "295137114391504089515018675642517607570",
                "80262785199644013748252000955575032980",
                "50897756805178067730859001372391933010",
                "189288108816640039897628512191732728630",
                "49135997035215881748108583489747220392",
                "106797815532387025773156295742883952923",
                "260376667315998339903250566823608735459",
                "28474064390371241892782856392491265052",
                "326377940604263333321429046212656857481",
                "213445769774528439287854631163672561238",
                "83712288552666989605557351792373913655",
                "23896908444203129741592742301721365666",
                "95730824479310877196554532695680831402",
                "147187001208560514174407022968433982594",
                "117013043819244182043076303917709665084",
                "313674175250437697047793984042090728965",
                "290599155828499049978459139433591969197",
                "313105664353177041758876549622159508865",
                "228675245368411129494010668974760295201",
                "175804769037330154093918426155136574819",
                "115849302903216931614787191482889875544",
                "275850730537794199189742190759002704378",
                "193461675831458286366228446674996684077",
                "300458708847578075210952934458908202346"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-120247-e847178f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/ffmpeg/ffmpeg/commit/7c73707355708c846f718cca90096bc1a33c8989",
        "target": {
            "file": "libavcodec/huffyuvdec.c"
        }
    }
]
vanir_signatures_modified 
"2026-11-04T07:05:50Z"