Is CVE-2026-120247 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120247 being exploited in the wild.

How severe is CVE-2026-120247?

Medium severity, with a CVSS score of 5.5, published 1 November 2026.

Is there a fix for CVE-2026-120247?

A patch was published on 2026-10-11: Fix merged in PR #24869 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-120247 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-120247?

Check whether you run Ffmpeg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120247: FFmpeg Huffyuv decoder use of uninitialized memory

CVE-2026-120247 · Severity: medium · CVSS 5.5 · Published 2026-11-01

FFmpeg is a multimedia framework used to encode and decode video and audio. A flaw in the Huffyuv decoder allows attackers to craft malicious video files that expose heap memory contents in decoded frames. An attacker could extract sensitive information from memory by sending a specially crafted video to a user or service that processes Huffyuv-encoded media.

Technologies: Ffmpeg. Vendors: Ffmpeg.

Quick answers

Is CVE-2026-120247 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120247 being exploited in the wild.
How severe is CVE-2026-120247?: Medium severity, with a CVSS score of 5.5, published 1 November 2026.
Which products and versions are affected?: Ffmpeg 2.3 through 9.0.2.
Is there a fix for CVE-2026-120247?: A patch was published on 2026-10-11: Fix merged in PR #24869 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120247 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-120247?: Check whether you run Ffmpeg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Huffyuv decoder in FFmpeg fails to initialize memory when decoding BGR24/BGRA packed-RGB bitstreams with truncated entropy data. When decode_slice() encounters early-ending bitstreams, it adds uninitialized bytes from s->temp[0] into output pixels, allowing heap memory disclosure. A fix was merged to zero unwritten scratch memory in the decode_plane_bitstream() function.

Affected products

FFmpeg FFmpeg 2.3 through 9.0.2

Timeline

2026-11-01: disclosed: CVE-2026-120247 published
2026-10-11: patched: Fix merged in PR #24869

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.