# CVE-2026-120247: FFmpeg Huffyuv decoder use of uninitialized memory

Source: https://junglewise.ai/threats/cve-2026-120247-ffmpeg-2-3-through-9-0-2-contains-a-use-of-uninitialized  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-120247 · Severity: medium · CVSS 5.5 · Published 2026-11-01

FFmpeg is a multimedia framework used to encode and decode video and audio. A flaw in the Huffyuv decoder allows attackers to craft malicious video files that expose heap memory contents in decoded frames. An attacker could extract sensitive information from memory by sending a specially crafted video to a user or service that processes Huffyuv-encoded media.

Technologies: [Ffmpeg](https://junglewise.ai/threats/technologies/ffmpeg). Vendors: [Ffmpeg](https://junglewise.ai/threats/vendors/ffmpeg).

## Quick answers

**Is CVE-2026-120247 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120247 being exploited in the wild.

**How severe is CVE-2026-120247?** Medium severity, with a CVSS score of 5.5, published 1 November 2026.

**Which products and versions are affected?** Ffmpeg 2.3 through 9.0.2.

**Is there a fix for CVE-2026-120247?** A patch was published on 2026-10-11: Fix merged in PR #24869 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120247 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-120247?** Check whether you run Ffmpeg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Huffyuv decoder in FFmpeg fails to initialize memory when decoding BGR24/BGRA packed-RGB bitstreams with truncated entropy data. When decode_slice() encounters early-ending bitstreams, it adds uninitialized bytes from s->temp[0] into output pixels, allowing heap memory disclosure. A fix was merged to zero unwritten scratch memory in the decode_plane_bitstream() function.

## Affected products

- FFmpeg FFmpeg 2.3 through 9.0.2

## Timeline

- 2026-11-01: disclosed: CVE-2026-120247 published
- 2026-10-11: patched: Fix merged in PR #24869

## References

- [https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24869](https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24869)
- [https://github.com/FFmpeg/FFmpeg](https://github.com/FFmpeg/FFmpeg)

## Related threats

- [FFmpeg CDXL decoder use of uninitialized variable in HAM palette](https://junglewise.ai/threats/cve-2026-120246-ffmpeg-4-4-through-9-0-2-contains-a-use-of-uninitialized)
- [FFmpeg use-of-uninitialized-memory in Sun Raster decoding](https://junglewise.ai/threats/cve-2026-120245-ffmpeg-0-10-through-9-0-2-contains-a-use-of-uninitialized)
- [FFmpeg PCX decoder heap memory leak via uninitialized buffer](https://junglewise.ai/threats/cve-2026-120244-ffmpeg-2-1-through-9-0-2-contains-a-use-of-uninitialized)
- [FFmpeg uninitialized variable in Go2Meeting decoder](https://junglewise.ai/threats/cve-2026-120243-ffmpeg-2-0-through-9-0-2-contains-a-use-of-uninitialized)
- [FFmpeg path traversal in IMF demuxer](https://junglewise.ai/threats/cve-2026-120210-ffmpeg-5-0-through-9-0-2-contains-a-path-traversal-vulnerability)