CVE-2026-66038: FFmpeg Information Disclosure Vulnerability

CVE-2026-66038 Overview

CVE-2026-66038 is an information disclosure vulnerability in FFmpeg through version 8.1.2, affecting the LCL/ZLIB video decoder implemented in lcldec.c. The flaw allows a remote attacker to expose uninitialized heap memory by supplying a crafted media file containing a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from an uninitialized allocation. Leaked bytes can include pointer-derived allocator metadata, defeating Address Space Layout Randomization (ASLR) in long-lived media processing services. The issue is tracked under [CWE-908: Use of Uninitialized Resource].

Critical Impact
Attackers can leak uninitialized heap memory, including allocator pointers, through crafted media files processed by FFmpeg-based services, enabling ASLR bypass and subsequent memory-corruption exploitation.

Affected Products

FFmpeg versions up to and including 8.1.2
FFmpeg LCL/ZLIB video decoder (libavcodec/lcldec.c)
Applications and services embedding vulnerable FFmpeg builds for media transcoding or streaming

Discovery Timeline

2026-07-24 - CVE-2026-66038 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-66038

Vulnerability Analysis

The LCL (LossLess Codec Library) decoder in FFmpeg supports zlib-compressed video streams. When processing a frame, the decoder allocates a buffer sized to the declared frame dimensions and calls zlib_decomp() to inflate the compressed payload into that buffer. The function does not treat a truncated inflate result as an error. Execution continues into the RGB24 conversion path, which reads and copies the full buffer using the original frame dimensions. Bytes never written by the inflate operation retain their pre-allocation contents, and those contents propagate into the AVFrame output presented to callers. In long-running services that reuse heap arenas, the leaked region frequently contains allocator bookkeeping fields such as forward and backward chunk pointers.

Root Cause

The root cause is missing validation of the decompressed byte count against the expected frame size in zlib_decomp(). The decoder assumes attacker-controlled input will fill the entire allocation, and the allocation itself is not zero-initialized. This combination satisfies the pattern described in [CWE-908].

Attack Vector

An attacker delivers a malicious LCL/ZLIB-encoded media asset to any consumer that decodes untrusted video through FFmpeg. Suitable delivery paths include HTTP media uploads, streaming ingestion pipelines, thumbnail generators, and cloud transcoders. User interaction is limited to processing the file. No authentication is required, and the attack traverses the network. The output frame containing leaked heap bytes can be retrieved by the attacker whenever the service returns transcoded frames, screenshots, or previews.

No public proof-of-concept code is referenced in the advisory. For technical specifics, consult the VulnCheck Advisory on FFmpeg and the upstream FFmpeg Commit Notice.

Detection Methods for CVE-2026-66038

Indicators of Compromise

Media files declaring the LCL/ZLIB (MRLE/MSZH/ZLIB) codec whose inflated payload size is smaller than width * height * bytes_per_pixel.
Repeated submission of small, malformed AVI containers to public transcoding or thumbnail endpoints from a single source.
Output frames whose pixel regions contain high-entropy data inconsistent with the declared visual content.

Detection Strategies

Instrument FFmpeg-based services to log the ratio of inflated bytes to expected frame size inside zlib_decomp() and alert on short decompressions.
Deploy YARA or content-inspection rules that flag AVI files declaring LCL/ZLIB codecs originating from untrusted sources.
Correlate media-processing worker crashes, memory-scanner findings, or ASAN reports with recent LCL-encoded uploads.

Monitoring Recommendations

Track process telemetry from FFmpeg worker processes, including argument lines, input filenames, and codec identifiers extracted from ingested media.
Monitor outbound traffic from media pipelines for exfiltration of transcoded frames to unexpected destinations.
Ingest FFmpeg build and version inventory into a centralized data lake to identify hosts still running versions at or below 8.1.2.

How to Mitigate CVE-2026-66038

Immediate Actions Required

Upgrade FFmpeg to a build that includes upstream commit 8670835 (see FFmpeg Commit Notice) or a distribution package that backports the fix.
Rebuild and redeploy any containers, serverless functions, or bundled applications that statically link libavcodec.
Audit media ingestion services and restrict acceptance of LCL/ZLIB-encoded content until patched builds are in place.

Patch Information

The vulnerability is fixed in FFmpeg commit 8670835, referenced in the upstream FFmpeg Pull Request #23626. The patch validates the inflated byte count in zlib_decomp() and prevents progression to the RGB24 conversion path when the decompressed data does not fill the destination buffer.

Workarounds

Disable the LCL decoder at build time by configuring FFmpeg with --disable-decoder=zlib --disable-decoder=mszh and redeploying.
Filter uploads at the application layer to reject AVI containers advertising the MSZH or ZLIB FourCC codes.
Isolate media transcoding workloads in short-lived, sandboxed processes to reduce the value of any leaked heap contents.

bash

# Configuration example: rebuild FFmpeg without the vulnerable decoders
./configure \
    --disable-decoder=zlib \
    --disable-decoder=mszh \
    --enable-gpl \
    --prefix=/opt/ffmpeg-hardened
make -j"$(nproc)" && make install