# CVE-2026-120245: FFmpeg use-of-uninitialized-memory in Sun Raster decoding

Source: https://junglewise.ai/threats/cve-2026-120245-ffmpeg-0-10-through-9-0-2-contains-a-use-of-uninitialized  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-120245 · Severity: medium · CVSS 5.5 · Published 2026-11-01

FFmpeg is a multimedia framework used to decode and process audio and video files. A flaw in its Sun Raster image decoder allows attackers to craft a truncated image file that exposes stale heap memory contents in the decoded output, potentially leaking sensitive data from the application's memory.

Technologies: [Ffmpeg](https://junglewise.ai/threats/technologies/ffmpeg). Vendors: [Ffmpeg](https://junglewise.ai/threats/vendors/ffmpeg).

## Quick answers

**Is CVE-2026-120245 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120245 being exploited in the wild.

**How severe is CVE-2026-120245?** Medium severity, with a CVSS score of 5.5, published 1 November 2026.

**Which products and versions are affected?** Ffmpeg 0.10 through 9.0.2.

**Is there a fix for CVE-2026-120245?** Yes: fixed in FFmpeg 9.1 (merged 2026-10-10). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120245 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-120245?** Check whether you run Ffmpeg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in FFmpeg 9.1 (merged 2026-10-10)

## Technical details

The sunrast_decode_frame() function fails to initialize a temporary bitmap when decoding truncated 1-bit and 4-bit paletted Sun Raster images, leading to uninitialized memory being read and expanded into output pixels. An attacker can craft a malicious truncated Sun Raster file to trigger this condition and cause heap memory leaks such as allocator metadata to appear in the decoded image data.

## Affected products

- FFmpeg FFmpeg 0.10 through 9.0.2

## Timeline

- 2026-11-01: disclosed: CVE-2026-120245 published
- 2026-10-10: patched: Fix merged in PR #24877

## References

- [https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877](https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877)
- [https://github.com/FFmpeg/FFmpeg](https://github.com/FFmpeg/FFmpeg)

## Related threats

- [FFmpeg Huffyuv decoder use of uninitialized memory](https://junglewise.ai/threats/cve-2026-120247-ffmpeg-2-3-through-9-0-2-contains-a-use-of-uninitialized)
- [FFmpeg CDXL decoder use of uninitialized variable in HAM palette](https://junglewise.ai/threats/cve-2026-120246-ffmpeg-4-4-through-9-0-2-contains-a-use-of-uninitialized)
- [FFmpeg PCX decoder heap memory leak via uninitialized buffer](https://junglewise.ai/threats/cve-2026-120244-ffmpeg-2-1-through-9-0-2-contains-a-use-of-uninitialized)
- [FFmpeg uninitialized variable in Go2Meeting decoder](https://junglewise.ai/threats/cve-2026-120243-ffmpeg-2-0-through-9-0-2-contains-a-use-of-uninitialized)
- [FFmpeg path traversal in IMF demuxer](https://junglewise.ai/threats/cve-2026-120210-ffmpeg-5-0-through-9-0-2-contains-a-path-traversal-vulnerability)