{"id":"OESA-2026-4808","summary":"ffmpeg security update","details":"FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nFFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.(CVE-2026-107678)\n\nFFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.(CVE-2026-120243)\n\nFFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into visible decoded pixels.(CVE-2026-120244)\n\nFFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8 pixels, exposing stale heap contents such as allocator words in decoded output.(CVE-2026-120245)\n\nFFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palette entries in cdxl_decode_ham8() or cdxl_decode_ham6(), exposing stack bytes and pointer fragments in the BGR24 output.(CVE-2026-120246)\n\nFFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decode_slice() to add uninitialized s->temp[0] bytes into output frames, exposing heap contents.(CVE-2026-120247)","modified":"2026-11-11T12:45:08.003813095Z","published":"2026-11-11T12:26:22Z","upstream":["CVE-2026-107678","CVE-2026-120243","CVE-2026-120244","CVE-2026-120245","CVE-2026-120246","CVE-2026-120247"],"database_specific":{"severity":"Medium"},"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4808"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120243"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120244"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120245"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120246"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120247"}],"affected":[{"package":{"name":"ffmpeg","ecosystem":"openEuler:22.03-LTS-SP4","purl":"pkg:rpm/openEuler/ffmpeg&distro=openEuler-22.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-59.oe2203sp4"}]}],"ecosystem_specific":{"aarch64":["ffmpeg-4.2.4-58.oe2203sp4.aarch64.rpm","ffmpeg-debuginfo-4.2.4-58.oe2203sp4.aarch64.rpm","ffmpeg-debugsource-4.2.4-58.oe2203sp4.aarch64.rpm","ffmpeg-devel-4.2.4-58.oe2203sp4.aarch64.rpm","ffmpeg-libs-4.2.4-58.oe2203sp4.aarch64.rpm","libavdevice-4.2.4-58.oe2203sp4.aarch64.rpm"],"src":["ffmpeg-4.2.4-58.oe2203sp4.src.rpm","ffmpeg-4.2.4-59.oe2203sp4.src.rpm"],"x86_64":["ffmpeg-4.2.4-59.oe2203sp4.x86_64.rpm","ffmpeg-debuginfo-4.2.4-59.oe2203sp4.x86_64.rpm","ffmpeg-debugsource-4.2.4-59.oe2203sp4.x86_64.rpm","ffmpeg-devel-4.2.4-59.oe2203sp4.x86_64.rpm","ffmpeg-libs-4.2.4-59.oe2203sp4.x86_64.rpm","libavdevice-4.2.4-59.oe2203sp4.x86_64.rpm"]},"database_specific":{"source":"https://repo.openeuler.org/security/data/osv/OESA-2026-4808.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}]}