Bug 2564499 (CVE-2026-120244)

Summary: CVE-2026-120244 ffmpeg: ffmpeg: Information disclosure via truncated PCX image
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bbrownin
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in FFmpeg. An attacker could exploit this vulnerability by providing a specially crafted PCX image containing truncated image data. When processed, the PCX decoder copies uninitialized memory into the decoded image pixels, resulting in information disclosure of sensitive heap memory.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2564991, 2564994, 2564998, 2565001, 2565004, 2565008, 2565012, 2565014, 2565017, 2565020, 2565029, 2565032, 2565036, 2565039, 2565042, 2565046, 2565052    
Bug Blocks:    

Description OSIDB Bzimport 2026-11-01 01:02:20 UTC 
FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into visible decoded pixels.