# CVE-2026-120246: FFmpeg CDXL decoder use of uninitialized variable in HAM palette

Source: https://junglewise.ai/threats/cve-2026-120246-ffmpeg-4-4-through-9-0-2-contains-a-use-of-uninitialized  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-120246 · Severity: medium · CVSS 5.5 · Published 2026-11-01

FFmpeg is a multimedia framework used to encode, decode, and process audio and video files. A flaw in the CDXL decoder allows crafted video files to leak sensitive stack memory (including pointer fragments) into decoded video frames. An attacker could distribute a malicious CDXL file that, when decoded, exposes confidential information from the application's memory.

Technologies: [Ffmpeg](https://junglewise.ai/threats/technologies/ffmpeg). Vendors: [Ffmpeg](https://junglewise.ai/threats/vendors/ffmpeg).

## Quick answers

**Is CVE-2026-120246 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120246 being exploited in the wild.

**How severe is CVE-2026-120246?** Medium severity, with a CVSS score of 5.5, published 1 November 2026.

**Which products and versions are affected?** Ffmpeg 4.4 through 9.0.2.

**Is there a fix for CVE-2026-120246?** Yes: fixed in FFmpeg 9.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120246 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-120246?** Check whether you run Ffmpeg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in FFmpeg 9.1

## Technical details

The vulnerability exists in the HAM6 and HAM8 pixel decoders (cdxl_decode_ham6/ham8 functions) within the CDXL decoder component. When processing type-0 CDXL files with partially-filled palette entries, the decoder reads from uninitialized palette indices (10–15 for HAM6, 42–63 for HAM8), leaking stack bytes into BGR24 output pixels. The vulnerability requires processing a crafted CDXL input file but no user interaction beyond initiating decode. A fix validates palette indices before reading, rejecting frames that reference uninitialized entries.

## Affected products

- FFmpeg FFmpeg 4.4 through 9.0.2

## Timeline

- 2026-11-01: disclosed
- 2026-10-05: patched: Fix merged in commit 7266f70aa6 to master, scheduled for 9.1 release

## References

- [https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24856](https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24856)
- [https://github.com/FFmpeg/FFmpeg](https://github.com/FFmpeg/FFmpeg)

## Related threats

- [FFmpeg Huffyuv decoder use of uninitialized memory](https://junglewise.ai/threats/cve-2026-120247-ffmpeg-2-3-through-9-0-2-contains-a-use-of-uninitialized)
- [FFmpeg use-of-uninitialized-memory in Sun Raster decoding](https://junglewise.ai/threats/cve-2026-120245-ffmpeg-0-10-through-9-0-2-contains-a-use-of-uninitialized)
- [FFmpeg PCX decoder heap memory leak via uninitialized buffer](https://junglewise.ai/threats/cve-2026-120244-ffmpeg-2-1-through-9-0-2-contains-a-use-of-uninitialized)
- [FFmpeg uninitialized variable in Go2Meeting decoder](https://junglewise.ai/threats/cve-2026-120243-ffmpeg-2-0-through-9-0-2-contains-a-use-of-uninitialized)
- [FFmpeg path traversal in IMF demuxer](https://junglewise.ai/threats/cve-2026-120210-ffmpeg-5-0-through-9-0-2-contains-a-path-traversal-vulnerability)