{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120245", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-31T22:05:58.146Z", "datePublished": "2026-11-01T00:57:10.732Z", "dateUpdated": "2026-11-11T02:37:14.008Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-11T02:37:14.008Z"}, "datePublic": "2026-10-10T00:00:00.000Z", "title": "FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder", "descriptions": [{"lang": "en", "value": "FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that leaves decoded image regions unwritten for truncated input. Attackers can supply a crafted truncated Sun Raster image, RLE-encoded or raw, to leak stale heap contents such as allocator metadata through the decoded picture."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Use of Uninitialized Resource", "cweId": "CWE-908", "type": "CWE"}]}], "affected": [{"vendor": "FFmpeg", "product": "FFmpeg", "defaultStatus": "unaffected", "versions": [{"version": "0.10", "lessThanOrEqual": "9.0.2", "status": "affected", "versionType": "custom"}], "packageURL": "pkg:github/ffmpeg/ffmpeg", "repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.10", "versionEndIncluding": "9.0.2"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877", "tags": ["issue-tracking"]}, {"url": "https://github.com/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180", "tags": ["patch"]}, {"url": "https://github.com/FFmpeg/FFmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e", "tags": ["patch"]}, {"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c#L188-L194", "tags": ["technical-description"]}, {"url": "https://github.com/FFmpeg/FFmpeg", "tags": ["product"]}, {"name": "VulnCheck Advisory: FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/ffmpeg-0.10-through-9.0.2-uninitialized-memory-disclosure-via-sun-raster-decoder"}], "credits": [{"lang": "en", "value": "Adrian Junge (vurlo)", "type": "finder"}, {"lang": "en", "value": "Joshua Rogers (AISLE Research)", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T14:39:53.499385Z", "id": "CVE-2026-120245", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T14:40:04.609Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-120245", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T14:39:53.499385Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T14:39:58.350Z"}}], "cna": {"title": "FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder", "credits": [{"lang": "en", "type": "finder", "value": "Adrian Junge (vurlo)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg", "vendor": "FFmpeg", "product": "FFmpeg", "versions": [{"status": "affected", "version": "0.10", "versionType": "custom", "lessThanOrEqual": "9.0.2"}], "packageURL": "pkg:github/ffmpeg/ffmpeg", "defaultStatus": "unaffected"}], "datePublic": "2026-10-10T00:00:00.000Z", "references": [{"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877", "tags": ["issue-tracking"]}, {"url": "https://github.com/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180", "tags": ["patch"]}, {"url": "https://github.com/FFmpeg/FFmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e", "tags": ["patch"]}, {"url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c#L188-L194", "tags": ["technical-description"]}, {"url": "https://github.com/FFmpeg/FFmpeg", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/ffmpeg-0.10-through-9.0.2-uninitialized-memory-disclosure-via-sun-raster-decoder", "name": "VulnCheck Advisory: FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-908", "description": "Use of Uninitialized Resource"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "9.0.2", "versionStartIncluding": "0.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-01T00:57:10.732Z"}}}, "cveMetadata": {"cveId": "CVE-2026-120245", "state": "PUBLISHED", "dateUpdated": "2026-11-02T14:40:04.609Z", "dateReserved": "2026-10-31T22:05:58.146Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-01T00:57:10.732Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/ffmpeg/ffmpeg", "product": "FFmpeg", "repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg", "vendor": "FFmpeg", "versions": [{"lessThanOrEqual": "9.0.2", "status": "affected", "version": "0.10", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output."}], "id": "CVE-2026-120245", "lastModified": "2026-11-02T19:34:23.993", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-120245", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T14:39:53.499385Z", "version": "2.0.3"}}]}, "published": "2026-11-01T01:17:17.960", "references": [{"source": "disclosure@vulncheck.com", "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/FFmpeg/FFmpeg"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c#L188-L194"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/FFmpeg/FFmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/ffmpeg-0.10-through-9.0.2-uninitialized-memory-disclosure-via-sun-raster-decoder"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-908"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "ffmpeg: ffmpeg: Information disclosure via crafted Sun Raster image", "id": "2564503", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564503"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-908", "details": ["A flaw was found in FFmpeg. An attacker could exploit this vulnerability by tricking a user or automated system into processing a specially crafted Sun Raster image file. Because the decoder fails to properly initialize memory buffers when handling truncated image data, uninitialized system memory is copied into the decoded image output. Successful exploitation allows an attacker to obtain sensitive information from heap memory."], "name": "CVE-2026-120245", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "ffmpeg", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-aws-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-azure-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-azure-rocm-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-gcp-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rhelai3/bootc-rocm-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-vllm-gaudi-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-11-01T00:57:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-120245\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-120245\nhttps://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877\nhttps://github.com/FFmpeg/FFmpeg\nhttps://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c#L188-L194\nhttps://github.com/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180\nhttps://github.com/FFmpeg/FFmpeg/commit/66b6ca270b33fd74367d7d371f6de16ec664446e\nhttps://www.vulncheck.com/advisories/ffmpeg-0.10-through-9.0.2-uninitialized-memory-disclosure-via-sun-raster-decoder"], "threat_severity": "Moderate"}