FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.

Etkilenen sürümler1 yazılım

Kaynaklar8 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ommit/356a391bf57df2fb80fd61f2821c8c83d15ce180 Yama
• github.com/…ommit/66b6ca270b33fd74367d7d371f6de16ec664446e Yama
• code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877 Üçüncü taraf
• vulncheck.com/…lized-memory-disclosure-via-sun-raster-decoder Üçüncü taraf
• github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sunrast.c Diğer
• github.com/FFmpeg/FFmpeg Diğer

Kayıt geçmişi

1. 1 Kas 2026 03:57Yayımlandı

İlgili açıklar

• 5,5 CVE-2026-120247FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure
• 5,5 CVE-2026-120246FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder
• 5,5 CVE-2026-120244FFmpeg 2.1 through 9.0.2 Uninitialized Memory Leak via PCX Decoder
• 5,5 CVE-2026-120243FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette
• 4,3 CVE-2026-120210FFmpeg 5.0 through 9.0.2 Path Traversal via IMF Demuxer ASSETMAP Path
• 3,7 CVE-2026-119602libmspack through 0.11alpha Uninitialized Memory Disclosure via MS-ZIP Decompressor Window