FFmpeg CVE-2026-120246

Exploitation requires that FFmpeg decode an attacker-crafted type-0 CDXL file whose HAM pixels in cdxl_decode_ham8() or cdxl_decode_ham6() select new_palette entries that import_palette() never filled; those unfilled entries are what emit uninitialized stack memory into the BGR24 output. Limiting factors: the CVSS vector is local (AV:L) and requires passive user interaction (UI:P) - the malicious file must be processed/opened in a context using the CDXL decoder - and the data only reaches the attacker if the decoded output is returned to or observed by them. No authentication is required (PR:N). The vulnerable path is the niche CDXL HAM6/HAM8 decode mode, not a default network-facing surface.

This is a moderate-severity information-disclosure issue (CWE-457, use of uninitialized variable), not a priority emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N, 6.8) shows the dominant limiting factors clearly: the vector is LOCAL (AV:L) and requires passive user interaction (UI:P) - a victim must decode an attacker-supplied CDXL file - while impact is confined to confidentiality (VC:H) with no integrity or availability effect, consistent with a stack-memory leak into decoded pixels. No EPSS score and no KEV/SSVC automatable signal were supplied, so exploitation probability cannot be quantified from the input; the vuln.today decision label is 'this_month', i.e. patch on a routine cadence rather than act_now or emergency. The confidentiality rating is high because the leak can expose pointer fragments (useful for defeating ASLR), but realistically the attacker only benefits if the rendered BGR24 output is returned to them, which bounds practical exploitability. Net: a genuine but non-urgent memory-disclosure bug whose risk is capped by local vector, required user interaction, and the niche CDXL HAM decode path rather than a high-CVSS/low-real-risk mismatch.

An attacker crafts a malicious type-0 CDXL video file whose HAM pixels reference palette slots that were never populated, then gets a victim or an automated pipeline to decode it with FFmpeg. During cdxl_decode_ham8()/cdxl_decode_ham6() the unfilled new_palette entries emit uninitialized stack bytes and pointer fragments into the BGR24 output frame, which the attacker can read back if the decoded image is returned, transcoded, or displayed to them. No public exploit identified at time of analysis; only the vendor fix PR and patch commit are referenced.