CVE-2026-66038
Received Received - Intake

Information Disclosure in FFmpeg via ZLIB Decoder

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: VulnCheck

Description
FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-25
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-66038
EUVD
EUVD-2026-48740

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ffmpeg ffmpeg to 8.1.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-908 The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-66038 is an information disclosure vulnerability in FFmpeg versions up to 8.1.2. It occurs in the LCL/ZLIB video decoder when a valid zlib stream decompresses to fewer bytes than expected. The zlib_decomp() function incorrectly treats this as non-fatal and proceeds to RGB24 conversion, copying uninitialized heap memory into the output frame. This exposes sensitive data like allocator metadata and may bypass ASLR in long-lived services.

Detection Guidance

Detecting this vulnerability requires analyzing FFmpeg binaries or media processing services for the presence of the vulnerable zlib_decomp() function in lcldec.c. Check if your FFmpeg version is 8.1.2 or earlier. Inspect logs for crashes or memory corruption during video decoding, particularly with zlib-compressed streams. Use static analysis tools to scan for the vulnerable function in compiled binaries.

Impact Analysis

An attacker could exploit this to read uninitialized memory from FFmpeg processes, potentially accessing sensitive data such as credentials, keys, or other secrets. Systems processing media files from untrusted sources are at higher risk. The vulnerability may also enable bypassing ASLR protections in long-running services.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations processing sensitive media data may face compliance violations if attackers access protected information through this flaw.

Mitigation Strategies

Immediately upgrade FFmpeg to a version that includes commit 8670835 or later. If upgrading is not possible, disable LCL/ZLIB video decoding in FFmpeg configurations or services. Monitor media processing services for unusual memory leaks or crashes. Apply ASLR hardening to mitigate potential bypasses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66038. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart