FFmpeg 8.1.2 LCL/ZLIB Decoder Leak of Uninit Heap via Short Decompression
CVE-2026-66038 Published on July 24, 2026
FFmpeg LCL/ZLIB Video Decoder Information Disclosure via lcldec.c
FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.
Vulnerability Analysis
CVE-2026-66038 is exploitable with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Use of Uninitialized Resource
The software uses or accesses a resource that has not been initialized. When a resource has not been properly initialized, the software may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the software.
Products Associated with CVE-2026-66038
Want to know whenever a new CVE is published for FFmpeg? stack.watch will email you.
Affected Versions
FFmpeg:- Before and including 8.1.2 is affected.
- Version 86708357d126af84c16f80d9c57335d1e8c845c5 is unaffected.