Skip to main content

FFmpeg CVE-2026-66038

| EUVDEUVD-2026-48740 HIGH
Use of Uninitialized Resource (CWE-908)
2026-07-24 VulnCheck
Information Disclosure Ffmpeg
7.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-delivered malicious media requires passive processing (UI:R); heap pointer leakage yields high confidentiality impact; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 26, 2026 - 11:40 vuln.today
CVE Published
Jul 24, 2026 - 19:39 cve.org
HIGH 7.1

DescriptionCVE.org

FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.

AnalysisAI

Uninitialized heap memory disclosure in FFmpeg's LCL/ZLIB video decoder (lcldec.c, through version 8.1.2) allows a remote attacker to exfiltrate heap contents - including pointer-derived allocator metadata - by supplying a crafted media file containing a syntactically valid zlib stream that inflates to fewer bytes than the declared frame size. The zlib_decomp() function treats a short-decompress result as non-fatal and falls through to the RGB24 conversion path, which reads full-frame-dimension rows from the partially-filled allocation buffer, copying uninitialized bytes into the attacker-observable AVFrame output. The practical threat is ASLR bypass in long-lived media processing services, making this a potential stepping stone in a multi-stage exploit chain rather than a standalone critical issue. No public exploit code exists and EPSS is 0.26% (17th percentile); CISA SSVC rates exploitation as none at time of analysis.

Technical ContextAI

FFmpeg (cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*) is a widely deployed multimedia processing library. The affected code path is the LCL (LossLess Codec Library) decoder with ZLIB compression, implemented in libavcodec/lcldec.c. The root cause is CWE-908 (Use of Uninitialized Resource): zlib_decomp() performs decompression into a heap-allocated frame buffer but does not treat a short-output condition (inflated bytes < expected frame size) as an error. Control passes unguarded to the RGB24 pixel format conversion loop, which iterates over the full original frame dimensions and copies data from the allocation region regardless of how many bytes were actually decompressed. Because heap allocations retain bytes from prior allocations, the output AVFrame can contain pointer-derived values from the allocator's internal metadata, exposing information useful for defeating ASLR. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N reflects that delivery is network-reachable but requires passive user/service interaction (opening the file) and has no integrity or availability impact.

RemediationAI

The primary fix is to update FFmpeg to a build incorporating upstream commit e7cbfd1c507b57a806a5825b87d609963e862c8c, which corrects zlib_decomp() to treat short decompression as a fatal error and abort decoding before the RGB24 conversion path. The patch reference is available at https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c and the corresponding pull request at https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626. Ubuntu users should apply the update published under USN-8671-1 (https://ubuntu.com/security/notices/USN-8671-1). An exact patched release version number beyond the commit hash is not independently confirmed from available data - verify against the FFmpeg changelog or distribution packages. As a compensating control, operators of media processing services that do not require LCL/ZLIB codec support can disable or remove the LCL decoder at build time (--disable-decoder=lcl) with no impact on common codec workflows; this eliminates the attack surface entirely. Services that accept untrusted user-uploaded media should validate or reject LCL/ZLIB-encoded content at ingestion until the patch is applied.

More in Ffmpeg

View all
CVE-2016-1897 MEDIUM POC
5.5 Jan 15

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol
CVE-2017-9993 HIGH
7.5 Jun 28

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restric
CVE-2016-1898 MEDIUM POC
5.5 Jan 15

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protoco
CVE-2013-4265 CRITICAL POC
10.0 Nov 23

The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors re
CVE-2020-12284 CRITICAL POC
9.8 Apr 28

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MA
CVE-2026-58049 HIGH POC
8.8 Jun 28

Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt m
CVE-2021-38094 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacker
CVE-2021-38093 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacke
CVE-2021-38092 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
CVE-2021-38091 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
CVE-2021-38090 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows atta
CVE-2021-30123 HIGH POC
8.8 Apr 07

FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP4-LTSS Affected

Share

CVE-2026-66038 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy