Is CVE-2026-120244 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120244 being exploited in the wild.

How severe is CVE-2026-120244?

Medium severity, with a CVSS score of 5.5, published 1 November 2026.

Is there a fix for CVE-2026-120244?

Yes: fixed in FFmpeg 9.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-120244 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-120244?

Check whether you run Ffmpeg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120244: FFmpeg PCX decoder heap memory leak via uninitialized buffer

CVE-2026-120244 · Severity: medium · CVSS 5.5 · Published 2026-11-01

FFmpeg is a widely used multimedia library that decodes and encodes video and audio files. A vulnerability in its PCX image decoder allows an attacker to craft a malicious PCX image that leaks uninitialized heap memory from the decoding process. An attacker could use this to extract sensitive data like cryptographic keys or other information that happened to be in memory.

Technologies: Ffmpeg. Vendors: Ffmpeg.

Quick answers

Is CVE-2026-120244 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120244 being exploited in the wild.
How severe is CVE-2026-120244?: Medium severity, with a CVSS score of 5.5, published 1 November 2026.
Which products and versions are affected?: Ffmpeg 2.1 through 9.0.2.
Is there a fix for CVE-2026-120244?: Yes: fixed in FFmpeg 9.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120244 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-120244?: Check whether you run Ffmpeg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FFmpeg 9.1

Technical details

The PCX decoder's RLE (run-length encoding) scanline decompression fails to properly zero-initialize buffer contents when truncated input ends prematurely. An attacker can craft a PCX file where RLE data terminates before a full scanline is decoded, causing uninitialized heap contents from av_malloc() to be copied into visible decoded pixels. The vulnerability exists in the pcx_decode_frame() function in libavcodec/pcx.c and is triggered by network-supplied untrusted PCX image input.

Affected products

FFmpeg FFmpeg 2.1 through 9.0.2

Timeline

2026-11-01: disclosed
2026-10-11: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.