FFmpeg PCX Decoder Uninitialized Memory Leak Vulnerability (CVE-2026-120244) Technical Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTFFmpeg versions 2.1 through 9.0.2 containing the PCX image decoder
Attackers can leak sensitive heap memory contents into visible decoded pixels by crafting truncated PCX images
Apply the official FFmpeg patch commit or upgrade to a non-vulnerable release version
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
If you compile FFmpeg from source, apply the official patch commit ecd5dfc308a164757e7f25b1afefd8db21b43cf9 and rebuild the binaries.
# Clone FFmpeg repository and checkout the patched commit
git clone https://github.com/FFmpeg/FFmpeg.git
cd FFmpeg
git fetch --tags
git checkout ecd5dfc308a164757e7f25b1afefd8db21b43cf9
# Configure and compile
./configure --enable-shared --disable-static
make -j$(nproc)
sudo make install
sudo ldconfig2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, restrict or disable the processing of PCX files at the application gateway or reverse proxy level.
# Block PCX file uploads in Nginx configuration
server {
listen 80;
server_name media.example.com;
# Deny access and upload of .pcx files
location ~* \.(pcx)$ {
deny all;
return 403 'PCX format is not allowed due to security policy.';
}
}3. Log Audit & IoC Verification Commands
Use the following script to verify the installed FFmpeg version and scan for any PCX files within your upload directories.
#!/bin/bash
# Check installed FFmpeg version
if command -v ffmpeg >/dev/null 2>&1; then
FFMPEG_VER=$(ffmpeg -version | head -n 1 | awk '{print $3}')
echo '[INFO] Detected FFmpeg Version: '$FFMPEG_VER
else
echo '[WARNING] FFmpeg is not installed or not in PATH.'
fi
# Scan for PCX files in the upload directory
TARGET_DIR='/var/www/uploads'
echo '[INFO] Scanning for PCX files in '$TARGET_DIR
find '$TARGET_DIR' -type f -name '*.pcx' 2>/dev/nullScan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2026-120244) is an uninitialized resource usage flaw (CWE-908) located within the PCX image decoder (libavcodec/pcx.c) of the FFmpeg framework. FFmpeg allocates memory buffers for decoding using av_malloc(), which does not zero-initialize the allocated space. When processing a malformed PCX image where the Run-Length Encoding (RLE) scanline data ends prematurely, the pcx_decode_frame() function fails to populate the entire buffer, leaving residual heap memory intact.
2. Exploitation Mechanics & Attack Scenario
An attacker can craft a malicious PCX image with truncated RLE data. When this image is processed by an application utilizing an affected version of FFmpeg (such as media transcoding services or automated thumbnail generators), the decoder copies the uninitialized av_malloc() buffer contents directly into the visible decoded pixels of the output image. By analyzing the pixel values of the generated output, the attacker can reconstruct fragments of heap memory, potentially exposing sensitive data from other processes, such as cryptographic keys, session tokens, or memory addresses.
3. Infrastructure & Business Impact
Although rated with a CVSS score of 5.5 (Medium), this vulnerability poses a significant risk to cloud-native media processing pipelines and multi-tenant SaaS platforms. A successful exploit can lead to unauthorized information disclosure, violating data privacy regulations. Furthermore, leaking memory layout details can assist attackers in bypassing exploit mitigation mechanisms like ASLR, facilitating more severe secondary attacks.
Official Vendor Advisories & References
FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into visible decoded pixels.
Frequently Asked SecOps Questions (CVE-2026-120244)
FAQQ1. How critical is CVE-2026-120244 and is it actively exploited in the wild?
CVE-2026-120244 is rated CVSS 5.5 (MEDIUM) with a 30-day EPSS exploitation probability of 0.1%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-120244?
Primary impacted vendors include ffmpeg across ffmpeg. Scope summary: FFmpeg versions 2.1 through 9.0.2 (all releases within this range utilizing the PCX decoder)
Q3. What temporary mitigations or workarounds exist for CVE-2026-120244 before patching?
[Mitigation] Apply the official FFmpeg patch commit or upgrade to a non-vulnerable release version Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-120244
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (ffmpeg)
View Category →FFmpeg Go2Meeting Decoder Uninitialized Variable Stack Memory Leak (CVE-2026-120243) Technical Advisory
[Affected Scope] FFmpeg versions 2.0 through 9.0.2 containing the Go2Meeting (G2M) decoder
GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Google Brotli Decoder Remote Code Execution (RCE) and Memory Corruption Vulnerability (CVE-2026-111497)
[Affected Scope] All web servers, browsers, Node.js environments, and backend applications using Google Brotli library versions 1.0.3 through 1.2.0
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.