Information Disclosure in FFmpeg LCL/ZLIB Video Decoder
CVE-2026-66038

7.1HIGH

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
24 July 2026

What is CVE-2026-66038?

The LCL/ZLIB video decoder in FFmpeg is susceptible to an information disclosure that allows attackers to reveal uninitialized heap memory. This occurs when a valid zlib stream is processed but inflates to fewer bytes than expected, leading to improper handling in the zlib_decomp() function. Instead of treating the short decomposition as an error, it progresses to RGB24 conversion, inadvertently copying potentially sensitive uninitialized data into the output. This vulnerability can compromise memory safety and potentially circumvent Address Space Layout Randomization (ASLR) in long-running media processing services.

Affected Version(s)

FFmpeg 0 <= 8.1.2

FFmpeg 0 <= 8.1.2

FFmpeg 86708357d126af84c16f80d9c57335d1e8c845c5

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626
issue-tracking
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b...
patch
https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-vide...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adrian Junge (vurlo)
.