CVE-2026-66038

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 8.1.2

Description An information disclosure issue exists in the LCL/ZLIB video decoder. An attacker can expose uninitialized heap memory by providing a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib decomp() function in lcldec.c treats short decompression as non-fatal and proceeds to the RGB24 conversion path. This process copies a full frame of rows from the allocation buffer based on original frame dimensions, resulting in uninitialized heap contents, such as pointer-derived allocator bytes, being copied into the AVFrame output. This could potentially defeat Address Space Layout Randomization (ASLR), a security technique that randomly arranges the address space positions of key data areas of a process to prevent exploitation.

Recommendations Update FFmpeg to the version containing commit 8670835.