FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ommit/7c73707355708c846f718cca90096bc1a33c8989 Yama
• code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24869 Üçüncü taraf
• vulncheck.com/…v-decoder-uninitialized-heap-memory-disclosure Üçüncü taraf
• github.com/…peg/FFmpeg/blob/n9.0.2/libavcodec/huffyuvdec.c Diğer
• github.com/FFmpeg/FFmpeg Diğer

Kayıt geçmişi

1. 1 Kas 2026 03:57Yayımlandı

İlgili açıklar

• 5,5 CVE-2026-120246FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder
• 5,5 CVE-2026-120244FFmpeg 2.1 through 9.0.2 Uninitialized Memory Leak via PCX Decoder
• 5,5 CVE-2026-120245FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder
• 5,5 CVE-2026-120243FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette
• 4,3 CVE-2026-120210FFmpeg 5.0 through 9.0.2 Path Traversal via IMF Demuxer ASSETMAP Path
• 3,7 CVE-2026-119602libmspack through 0.11alpha Uninitialized Memory Disclosure via MS-ZIP Decompressor Window