CVE-2026-66038 Details
Description
FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.
A vulnerability allowing information disclosure has been identified in FFmpeg versions through 8.1.2, within the LCL/ZLIB video decoder. This issue arises because the zlib_decomp() function in lcldec.c does not properly handle short decompressions, allowing attackers to exploit uninitialized heap memory. By supplying a valid zlib stream that inflates to fewer bytes than the expected frame size, an attacker can manipulate the RGB24 conversion process. This exploitation could lead to the leakage of uninitialized heap contents, including sensitive allocator bytes, into the observable AVFrame output. Such a breach could potentially undermine Address Space Layout Randomization (ASLR) in services that process media over extended periods.
Users can upgrade to FFmpeg version 9.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-908 | Use of Uninitialized Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ffmpeg ffmpeg | <= 8.1.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | Initial Analysis | [email protected] |
| Jul 24, 2026 | CVE Modified | CISA-ADP |
| Jul 24, 2026 | New CVE Received | [email protected] |