CVE-2026-66038 in FFmpeg
Summary
by MITRE • 07/24/2026
FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/26/2026
This vulnerability resides within the FFmpeg multimedia framework's LCL/ZLIB video decoder implementation, specifically affecting versions through 8.1.2 and addressed by commit 8670835. The flaw manifests when processing malformed zlib-compressed video streams where the decompressed data size falls short of the expected frame dimensions. The vulnerability stems from improper error handling within the zlib_decomp() function located in lcldec.c, which treats incomplete decompression operations as non-fatal conditions rather than terminating the decoding process. This design flaw creates a path where the decoder continues execution despite receiving insufficient compressed data, ultimately leading to information disclosure through memory exposure.
The technical mechanism of exploitation involves the decoder's handling of short decompression results during the RGB24 conversion phase. When the zlib decompression produces fewer bytes than anticipated for a complete frame, the system continues processing instead of rejecting the malformed input. The subsequent RGB24 conversion routine copies data based on the original frame dimensions rather than the actual decompressed data size, resulting in uninitialized heap memory contents being transferred to the output AVFrame structure. This memory copying operation inadvertently includes allocator metadata, pointer values, and other sensitive heap information that should remain private from external observation.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially compromise system security mechanisms. The exposure of uninitialized heap memory can reveal critical pointer-derived allocator bytes, which may contain addresses of allocated memory regions or other sensitive data structures. This information leakage poses significant risks to long-lived media processing services where ASLR (Address Space Layout Randomization) protections could be defeated through repeated exploitation attempts. Attackers can leverage this vulnerability to harvest memory layout information that would otherwise be protected by modern security mitigations, making subsequent attacks more effective.
This vulnerability maps directly to CWE-200 (Information Exposure) and CWE-457 (Use of Uninitialized Variables) within the Common Weakness Enumeration framework, demonstrating how improper error handling leads to unintended information disclosure. From an ATT&CK perspective, this represents a technique for initial access and reconnaissance through information gathering, potentially enabling more sophisticated attacks such as privilege escalation or further exploitation. The vulnerability affects systems processing multimedia content where FFmpeg serves as the underlying decoding library, including web servers, media processing services, and content delivery networks that may be targeted by adversaries seeking to harvest memory contents for exploitation purposes.
The recommended mitigation approach involves upgrading to FFmpeg version containing commit 8670835 or applying the specific patch that corrects the error handling in zlib_decomp() function. Organizations should also implement proper input validation measures and consider deploying additional security controls such as sandboxing for media processing components. Regular security assessments of multimedia processing pipelines are essential to identify similar vulnerabilities in other codecs or libraries that may exhibit analogous error handling patterns, particularly those involving memory allocation and decompression operations where incomplete data processing could lead to information leakage through uninitialized memory exposure.