FFmpeg Decoder Uninitialized Memory Leaks

Heap memory disclosure in FFmpeg's PCX decoder affects versions 2.1 through 9.0.2: a crafted PCX image whose RLE-encoded scanline data terminates early causes pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into the visible decoded pixels, leaking heap bytes to whoever receives the output image. Impact is confidentiality-only (no code execution, no write, no denial of service) and the assessed 3.1 vector is AV:L/AC:L/PR:N/UI:R, meaning the crafted file must reach a decode path - locally or through an automated service - before the leak occurs. No public exploit code and no confirmed active exploitation were identified at time of analysis; practical exposure is concentrated in media transcoders, thumbnail generators and upload-processing pipelines that automatically decode untrusted PCX input, and an upstream fix commit is available.

An information disclosure flaw in FFmpeg's Go2Meeting (G2M) decoder lets an attacker who supplies a crafted G2M3/G2M4 stream read uninitialized stack memory, because out-of-range Kempf palette indices cause kempf_restore_buf() to copy stale stack bytes - potentially pointers or stack guards - into the decoded frame. FFmpeg 2.0 through 9.0.2 are affected; exploitation requires the victim or an automated media pipeline to decode the crafted file and a way to observe the resulting decoded output, and it grants no integrity or availability impact. The upstream fix (commit edad2d0dafcf44fa315eab716fd0183ce808053b, PR 24858) adds a col >= npal bounds check; no public exploit code has been identified at time of analysis and CVE-2026-120243 is not in CISA KEV.

Heap memory disclosure in FFmpeg's Huffyuv decoder affects builds from 2.3 through 9.0.2: when a crafted Huffyuv (FFVHuff/HuffYUV) video in packed BGR24 or BGRA pixel format ends its entropy data early, decode_slice() adds uninitialized s->temp[0] bytes into the decoded frame, so heap contents are written into output pixels. The trigger is local with passive user interaction (CVSS:4.0/AV:L/UI:P, PR:N), and impact is confidentiality-only - no code execution, no crash, no integrity effect - and the attacker must be able to observe the decoded output to actually recover the leaked bytes. A vendor fix exists as an upstream PR/commit and the vuln.today decision label is this_month, indicating moderate rather than emergency priority; no public exploit code and no confirmed active exploitation were identified at time of analysis.

FFmpeg 0.10 through 9.0.2 can leak heap memory when decoding a deliberately truncated 1-bit or 4-bit paletted Sun Raster (.ras/.sun) image. The bug is a use of uninitialized resource (CWE-908) in sunrast_decode_frame(): the temporary bitmap is never cleared, so when it is expanded into PAL8 pixels the decoded frame can contain stale heap bytes such as allocator words. Impact is confidentiality-only and requires the victim to process the crafted file and for the attacker to observe the decoded output; there is no public exploit identified at time of analysis, and the vendor has published upstream fix commits.

Stack memory disclosure in FFmpeg 4.4 through 9.0.2 occurs in the niche CDXL decoder: when a crafted type-0 CDXL file is decoded in HAM6 or HAM8 mode, pixel values can index palette slots that import_palette() never populated, and those uninitialized stack bytes - including pointer fragments - are written into the BGR24 output frame. An attacker who can get a victim to open or process such a file, and who can observe the resulting decoded frames, may recover residual process memory; no authentication is required, but the assessed vector is local with passive user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), so impact is limited to confidentiality of data that is actually returned to the attacker. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and the vendor fix is upstreamed as a commit/PR rather than a confirmed tagged release.