FFmpeg CVE-2026-120245

Exploitation requires the victim to decode an attacker-supplied, deliberately TRUNCATED Sun Raster (.ras/.sun) image that uses 1-bit or 4-bit paletted format, which triggers the uncleared temporary bitmap in sunrast_decode_frame() to be expanded into PAL8 output (vulnerable code at libavcodec/sunrast.c around lines 188-194 in n9.0.2). Limiting factors: the victim must actively process the file (UI:P / local vector per CVSS), only this specific low-bit-depth paletted Sun Raster code path is affected, and the impact is confined to confidentiality - the attacker must additionally be able to observe the decoded output to recover the leaked heap bytes. Affected versions are FFmpeg 0.10 through 9.0.2; updating to the patched build is the fix per the vendor commits.

This is a moderate-severity information-disclosure flaw (CWE-908, use of uninitialized resource) rather than a top-priority emergency. The input CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N) scores 6.8 and tells a consistent story: exploitation requires local processing of an attacker-crafted file with passive user interaction, impacts confidentiality only (heap memory leak), and has no integrity or availability effect. There is no KEV listing, so this is NOT confirmed actively exploited; the vuln.today decision label is 'this_month' (routine remediation urgency, not act_now/emergency). No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the data. No public exploit code is identified - the references contain only the upstream fix PR, two patch commits, the vulnerable source lines, and a VulnCheck advisory, none of which is a working PoC. The signals are mutually consistent: a real but bounded issue whose impact is leakage of stale heap bytes (e.g. allocator words) into decoded output, not code execution or crash. One note for verification: the vector uses AV:L, yet FFmpeg frequently decodes media delivered over networks/streams, so some deployments may face a remote-ish delivery path even though the metric is scored local - confirm the delivery model for your environment.

An attacker crafts a truncated 1-bit or 4-bit paletted Sun Raster image and delivers it to a victim who opens or transcodes it with an FFmpeg-based tool. When sunrast_decode_frame() expands the uncleared temporary bitmap into PAL8 pixels, stale heap contents (such as allocator metadata) are emitted into the decoded output, which the attacker can then read back. No public exploit code is identified at time of analysis, and exploitation requires the victim to process the malicious file (UI:P).