Bug 2564497 (CVE-2026-120247)

Summary: CVE-2026-120247 ffmpeg: ffmpeg: Information disclosure via uninitialized heap memory in Huffyuv decoder
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bbrownin
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in FFmpeg. An attacker can achieve information disclosure by providing a specially crafted Huffyuv video stream with truncated data. Due to the use of an uninitialized buffer in the Huffyuv decoder, uninitialized heap memory is copied into the decoded output frames, exposing sensitive memory contents.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2565026, 2565027, 2565030, 2565034, 2565037, 2565040, 2565044, 2565048, 2565051, 2565055, 2565057, 2565060, 2565062, 2565065, 2565067, 2565071, 2565073    
Bug Blocks:    

Description OSIDB Bzimport 2026-11-01 01:02:06 UTC 
FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents.