CVE-2026-66038: FFmpeg LCL/ZLIB Video Decoder Information Disclosure via lcldec.c
FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlibdecomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpegto a version that resolves this vulnerability.Fixed in 8.1.2Patch commit 8670835 - Compensating control
For long-lived media processing services using FFmpeg’s LCL/ZLIB decoder (lcldec.c), mitigate exploitation by restricting or filtering inbound media streams so that attackers cannot supply crafted valid zlib streams that inflate to fewer bytes than the expected frame size.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66038?
CVE-2026-66038 has a medium severity rating with a score of 6.5.
How do I fix CVE-2026-66038?
To fix CVE-2026-66038, you should update FFmpeg to version 8.1.3 or later, where the vulnerability has been patched.
What kind of vulnerability is CVE-2026-66038?
CVE-2026-66038 is an information disclosure vulnerability in the LCL/ZLIB video decoder of FFmpeg.
What does CVE-2026-66038 affect?
CVE-2026-66038 affects FFmpeg versions up to 8.1.2.
What can attackers do with CVE-2026-66038?
Attackers can exploit CVE-2026-66038 to expose uninitialized heap memory by supplying a valid zlib stream.