Dashboard / CVE-2026-120245

CVE-2026-120245

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 39/100
Published: 2026-11-01 Modified: 2026-11-11 First seen: 2026-11-01 Status: active

Attack Surface

Low Complexity No Auth Conf. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: Passive
S: X
AT: None
VC: High
VI: None
VA: None

Description

FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that leaves decoded image regions unwritten for truncated input. Attackers can supply a crafted truncated Sun Raster image, RLE-encoded or raw, to leak stale heap contents such as allocator metadata through the decoded picture.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
FFmpeg FFmpeg 0.10
FFmpeg FFmpeg 0.10
FFmpeg FFmpeg 0.10

References & Advisories (6)

Bug Bounty Relevance

39 / 100
✓ No authentication
✓ Low complexity

CVSS Score

6.8 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.13%
Raw Score 0.001260
Percentile 2.3%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00126
2026-11-12
0.00126
2026-11-10
0.00124
2026-11-09
0.00124
2026-11-08
0.00124
2026-11-07
0.00124
2026-11-06
0.00124
2026-11-05
0.00124
2026-11-04
0.00124
2026-11-03
0.00124
2026-11-02
0.00124
2026-11-01
0.00124

Intelligence Sources

mitre ref →
nvd ref →

External Links