FFmpeg EUVD-2026-114741

Exploitation requires that a victim (or an automated service) decode an attacker-supplied PCX image using FFmpeg's PCX decoder (libavcodec/pcx.c), specifically a file whose RLE-encoded scanline data ends before bytes_per_scanline bytes are supplied. This is a LOCAL/file-processing vector with passive user interaction (UI:P): the attacker must get the crafted PCX into a decode path. Limiting factors: it is not remotely triggerable without the victim processing the file; impact is limited to disclosure of leaked uninitialized heap bytes rendered into output pixels (no code execution, no write/DoS); it affects FFmpeg versions 2.1 through 9.0.2, and updating to the fixed build (containing commit ecd5dfc) eliminates it. The practical exposure is highest in environments that automatically decode untrusted PCX input, such as media transcoders, thumbnail generators, and upload-processing pipelines.

This is a genuine but moderate-severity information-disclosure flaw (CWE-908, use of uninitialized resource), not a top-tier emergency. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N, 6.8) is internally consistent with the description: the attack vector is LOCAL and requires passive user interaction (UI:P), meaning a victim must decode an attacker-crafted PCX file rather than the flaw being remotely triggerable against a listening service. Impact is confined to confidentiality (VC:H) - leaked uninitialized heap bytes surface in decoded pixels - with no integrity or availability impact, so this is a memory-disclosure primitive, not code execution. The vuln.today decision label is 'this_month' (not act_now/emergency), and there is no CISA KEV listing and no EPSS score in the input, so there is no signal of active or widespread exploitation; the matching decision signals point to routine patching rather than emergency response. POC status: the references contain only the upstream fix PR and the patch commit - no public exploit reference is provided - so no public exploit is identified at time of analysis. The main caveat: AV:L plus UI:P describes a client-side/file-processing exposure, so real risk concentrates where FFmpeg automatically decodes untrusted PCX input (media pipelines, thumbnailers, transcoding services) rather than against servers at large.

An attacker crafts a PCX image whose RLE scanline data terminates early, then delivers it to a victim or service that decodes it with FFmpeg (e.g., a thumbnail generator or transcoding pipeline). When pcx_decode_frame() processes the truncated scanline it copies the unfilled, uninitialized av_malloc() buffer tail into the output, exposing residual heap contents in the visible decoded pixels. No public exploit code is identified at time of analysis; the only published artifacts are the vendor fix PR and patch commit.