CVE-2026-66038 affects FFmpeg through version 8.1.2 in the LCL/ZLIB video decoder component. The vulnerability is due to the zlib_decomp() function in lcldec.c treating short decompression results as non-fatal and continuing to the RGB24 conversion path. This path copies a full frame's worth of rows from the allocation buffer using the original frame dimensions, even when the decompressed data is smaller than expected. As a result, uninitialized heap memory, including pointer-derived allocator bytes, can be copied into the output AVFrame, exposing potentially sensitive information. This information disclosure can help attackers defeat ASLR protections in media processing services that use this decoder.

An attacker can supply a crafted zlib stream that decompresses to fewer bytes than expected, causing the decoder to leak uninitialized heap memory contents. This exposure of memory can reveal sensitive data and potentially aid in bypassing ASLR, increasing the risk of further exploitation in long-lived media processing environments. The vulnerability does not affect integrity or availability but has a high confidentiality impact.

A fix for this vulnerability is available in the FFmpeg codebase as of commit 8670835, which addresses the issue in the LCL/ZLIB video decoder. Users should upgrade to a version including this commit or later than 8.1.2. Since no official patch link is provided, users should consult the FFmpeg project repository or vendor advisories for the fixed version. There is no indication that the vulnerability is mitigated by default or requires no action.