Skip to content
OpenAdvisories
Medium WID-SEC-2026-4282 6 CVEs

ffmpeg: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Published Nov 1, 2026 · Updated Nov 1, 2026 · de-DE

Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ffmpeg ausnutzen, um Informationen offenzulegen.

Product

Das FFmpeg-Projekt besteht aus freien Programmen und Bibliotheken, die es ermöglichen, digitales Video- und Audiomaterial aufzunehmen, zu konvertieren, zu streamen und abzuspielen. Zudem enthält es mit libavcodec eine Audio- und Video-Codec-Sammlung, die verschiedene Codecs zur Verfügung stellt.

Vulnerabilities 6

  • Medium 5.5
    CVE-2026-120243

    FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette

    FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kem…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  • Medium 5.5
    CVE-2026-120244

    FFmpeg 2.1 through 9.0.2 Uninitialized Memory Leak via PCX Decoder

    FFmpeg 2.1 through 9.0.2 contains an uninitialized memory disclosure vulnerability in pcx_decode_frame() in libavcodec/pcx.c that leaves scanline buffer bytes uncleared when input ends early. Attackers can supply a crafted truncated RLE-compressed or uncompre…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  • Medium 5.5
    CVE-2026-120245

    FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder

    FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that leaves decoded image regions unwritten for truncated input. Attackers can supply a crafted truncated Sun Raster image, R…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  • Medium 5.5
    CVE-2026-120246

    FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder

    FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palet…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  • Medium 5.5
    CVE-2026-120247

    FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure

    FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy …

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  • Medium 4.3
    CVE-2026-120210

    FFmpeg 5.0 through 9.0.2 Path Traversal via IMF Demuxer ASSETMAP Path

    FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi

Revision history

  1. #1

    Initiale Fassung

References