Bug 2564505 (CVE-2026-120243)
| Summary: | CVE-2026-120243 ffmpeg: ffmpeg: information disclosure via crafted Go2Meeting stream | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | bbrownin |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in FFmpeg. This vulnerability allows an attacker to cause an information disclosure of sensitive stack memory by convincing a user to process a specially crafted Go2Meeting video stream. The Go2Meeting decoder fails to properly initialize palette data, which can result in uninitialized stack bytes, including memory addresses and security guards, being copied into the decoded video output.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2564969, 2564970, 2564972, 2564973, 2564974, 2564977, 2564980, 2564982, 2564984, 2564986, 2564989, 2564993, 2564996, 2565000, 2565003, 2565006, 2565009 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-11-01 01:02:45 UTC
|