FFmpeg Go2Meeting Decoder Uninitialized Variable Stack Memory Leak (CVE-2026-120243) Technical Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTFFmpeg versions 2.0 through 9.0.2 containing the Go2Meeting (G2M) decoder
Attackers can leak sensitive stack memory, including pointers and stack guards, by triggering out-of-range palette index copies
Upgrade to a patched version of FFmpeg or disable the vulnerable G2M decoder during compilation
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade FFmpeg to the latest stable release containing the official patch (commit edad2d0dafcf44fa315eab716fd0183ce808053b).
# For Debian/Ubuntu-based systems
sudo apt-get update && sudo apt-get install --only-upgrade -y ffmpeg
# For source installations, pull the latest stable branch and rebuild
git clone https://github.com/FFmpeg/FFmpeg.git
cd FFmpeg
git checkout n9.0.2
# Apply patch or pull latest stable branch
./configure --enable-shared
make -j$(nproc)
sudo make install2. Temporary Workaround & Hardening Configuration
If patching is not immediately feasible, disable the vulnerable G2M decoder during the configuration and compilation phase to mitigate the attack vector.
# Reconfigure FFmpeg build to exclude the vulnerable G2M decoder
./configure --disable-decoder=g2m --disable-parser=g2m
make -j$(nproc)
sudo make install3. Log Audit & IoC Verification Commands
Verify the installed FFmpeg version and check if the vulnerable G2M decoder is currently enabled in your environment.
# Check the installed FFmpeg version and configuration
ffmpeg -version
# Verify if the G2M decoder is active in the current binary
ffmpeg -decoders | grep -i g2mScan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2026-120243) is a use of uninitialized variable flaw (CWE-457) located within the Go2Meeting (G2M) decoder implementation (libavcodec/g2meet.c) of FFmpeg. The root cause lies in the insufficient validation of palette indices when processing Kempf palettes, allowing uninitialized stack memory bytes to be copied into the decoded output buffer.
2. Exploitation Mechanics & Attack Scenario
An attacker can craft a malicious G2M3 or G2M4 video stream containing a short Kempf palette. When FFmpeg attempts to decode this stream, the kempf_restore_buf() function is invoked. Due to the lack of proper bounds checking, the function copies uninitialized stack bytes—which may contain critical system data such as stack pointers or stack canaries (guards)—directly into the decoded output frame. By reading the resulting decoded video frames, the attacker can successfully leak stack memory, facilitating ASLR bypasses and subsequent exploitation chains.
3. Infrastructure & Business Impact
Since FFmpeg is widely integrated into media processing pipelines, cloud transcoding services, and enterprise video applications, this information disclosure vulnerability poses a significant risk. Exploitation allows remote attackers to map the application's memory layout, significantly lowering the barrier to executing more severe attacks such as Remote Code Execution (RCE) on the host infrastructure.
Official Vendor Advisories & References
FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.
Frequently Asked SecOps Questions (CVE-2026-120243)
FAQQ1. How critical is CVE-2026-120243 and is it actively exploited in the wild?
CVE-2026-120243 is rated CVSS 5.5 (MEDIUM) with a 30-day EPSS exploitation probability of 0.1%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-120243?
Primary impacted vendors include ffmpeg across ffmpeg. Scope summary: FFmpeg versions 2.0 through 9.0.2 with G2M decoder enabled
Q3. What temporary mitigations or workarounds exist for CVE-2026-120243 before patching?
[Mitigation] Upgrade to a patched version of FFmpeg or disable the vulnerable G2M decoder during compilation Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-120243
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (ffmpeg)
View Category →FFmpeg PCX Decoder Uninitialized Memory Leak Vulnerability (CVE-2026-120244) Technical Advisory
[Affected Scope] FFmpeg versions 2.1 through 9.0.2 containing the PCX image decoder
GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Google Brotli Decoder Remote Code Execution (RCE) and Memory Corruption Vulnerability (CVE-2026-111497)
[Affected Scope] All web servers, browsers, Node.js environments, and backend applications using Google Brotli library versions 1.0.3 through 1.2.0
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.