FFmpeg CVE-2026-120243

Exploitation requires the target to decode an attacker-supplied G2M3/G2M4 (Go2Meeting) stream in which the Kempf palette is deliberately short, so that a palette index exceeding the palette count (the col >= npal case the patch now rejects) drives kempf_restore_buf() to copy uninitialized stack bytes - potentially pointers or stack guards - into the decoded frame. No special build-time or runtime configuration is named in the sources beyond that the G2M decoder path must be reached. Limiting factors: the CVSS vector is local with passive user interaction (AV:L/UI:P), meaning a victim or an automated media pipeline must actually process the crafted file; no privileges are required (PR:N); and the attacker must be able to observe or retrieve the decoded output to recover the leaked memory. Impact is confined to information disclosure - there is no integrity or availability effect.

The input CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, VC:H, VI:N/VA:N) yields a 6.8 (Medium) score that is internally consistent with the description: this is not a remote-over-the-wire flaw but a file/stream-processing bug requiring a victim or automated pipeline to decode an attacker-crafted G2M3/G2M4 stream (UI:P), with impact limited to confidentiality (information disclosure of stack memory). No KEV listing is present, so there is no active-exploitation signal, and no EPSS score was supplied in the input - exploitation probability cannot be quantified and that gap should be noted rather than assumed low. There is no exploit-code reference in the provided data, only the patch commit, a pull request, source blobs, and a VulnCheck advisory, so this is best treated as no public exploit identified at time of analysis. The vuln.today decision label is this_month, consistent with a real-but-not-emergency information-disclosure issue. The practical value of the leak is above-average for an info-leak because the description states it can expose pointers or stack guards (ASLR/stack-canary material), making it a useful primitive within a larger exploit chain rather than a standalone compromise; however, the attacker must also be able to retrieve the decoded output to actually learn the leaked bytes, which further limits real-world impact.

An attacker crafts a G2M3/G2M4 (Go2Meeting) stream containing a short Kempf palette and delivers it to a target that decodes untrusted media with FFmpeg (e.g. a user opening the file or a server-side transcoding/thumbnailing service). When kempf_restore_buf() processes an out-of-range palette index it copies uninitialized stack bytes - potentially pointers or stack guards - into the decoded output, which the attacker then reads back to defeat ASLR/canary protections as part of a broader chain. No public exploit was identified in the provided data; given AV:L with UI:P, exploitation hinges on getting the victim/pipeline to decode the crafted stream.