CVE-2026-66038
Description
A flaw was found in FFmpeg, specifically within the LCL/ZLIB video decoder. A remote attacker could exploit this vulnerability by providing a specially crafted zlib stream that decompresses to a smaller size than expected. This can lead to the exposure of uninitialized heap memory, including sensitive data, which an attacker could observe in the AVFrame output. This information disclosure could potentially aid in bypassing Address Space Layout Randomization (ASLR) in long-running media processing services.
Statement
Our assessment reflects that this flaw strictly impacts Confidentiality with zero effect on Integrity or Availability (I:N, A:N). It cannot be exploited to crash services, corrupt heap memory, or execute arbitrary code.
For an exposure to occur, an attacker must supply a truncated LCL/ZLIB video stream to a service that not only decodes the frame, but explicitly encodes and outputs or streams that rendered frame back to an attacker-observable endpoint. In practice, uninitialized heap bytes (which may include allocator pointer addresses) are copied into the output frame buffer; however, reading these bytes requires an active, two-way media channel.
Systems or pipelines that process video content headlessly or internally (such as background media indexing, thumbnail extraction without public exposure, or one-way ingest) do not expose uninitialized memory to external observers and are not at risk of information leakage from this flaw.
Mitigation
To mitigate this issue, services utilizing FFmpeg for LCL/ZLIB video stream decoding should avoid returning raw, decoded frame data to untrusted external endpoints. Implement robust input validation for all video streams processed by such services. Additionally, consider sandboxing FFmpeg processes that handle untrusted video content to limit potential information exposure.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | 6.5 | 6.5 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | None | None | None |
| User Interaction | Required | Required | Required |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | High | High | High |
| Integrity Impact | None | None | None |
| Availability Impact | None | None | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory; Read Application Data
When reusing a resource such as memory or a program variable, the original contents of that resource may not be cleared before it is sent to an untrusted party.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
The uninitialized resource may contain values that cause program flow to change in ways that the programmer did not intend.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
