Libav: FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers… (CVE-2026-66038)
Affects libavSource GCVE Database
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 14% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 8.1.3, 7:2.8.17-0ubuntu0.1+esm15, 7:3.4.11-0ubuntu0.1+esm13 +4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHub Actionsffmpeg/FFmpegpkg:github/ffmpeg/FFmpegOther threats | Affected
| Fixed in
|
Ubuntu:Pro:14.04:LTSlibavpkg:deb/ubuntu/libav?arch=source&distro=esm-infra-legacy/trustyOther threats | Affected
| Fixed in– |
Ubuntu:Pro:16.04:LTSffmpegpkg:deb/ubuntu/ffmpeg?arch=source&distro=esm-apps-legacy/xenialOther threats | Affected
| Fixed in
|
Ubuntu:Pro:18.04:LTSffmpegpkg:deb/ubuntu/ffmpeg?arch=source&distro=esm-apps/bionicOther threats | Affected
| Fixed in
|
Ubuntu:Pro:20.04:LTSffmpegpkg:deb/ubuntu/ffmpeg?arch=source&distro=esm-apps/focalOther threats | Affected
| Fixed in
|
Ubuntu:Pro:22.04:LTSffmpegpkg:deb/ubuntu/ffmpeg?arch=source&distro=esm-apps/jammyOther threats | Affected
| Fixed in
|
Ubuntu:Pro:24.04:LTSffmpegpkg:deb/ubuntu/ffmpeg?arch=source&distro=esm-apps/nobleOther threats | Affected
| Fixed in
|
Ubuntu:26.10ffmpegpkg:deb/ubuntu/ffmpeg?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu:Pro:26.04:LTSffmpegpkg:deb/ubuntu/ffmpeg?arch=source&distro=esm-apps/resoluteOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A patch is available and should be applied to update FFmpeg (libav) to a version including commit 8670835 or later. Users should upgrade to a fixed version to remediate this vulnerability. No other specific mitigations are indicated.
Description
FFmpeg versions through 8.1.2 contain an information disclosure vulnerability in the LCL/ZLIB video decoder. This flaw allows attackers to expose uninitialized heap memory by providing a valid zlib stream that decompresses to fewer bytes than the expected frame size. The vulnerability arises because the decompression function treats short decompression as non-fatal and copies a full frame's worth of data from the allocation buffer, potentially leaking sensitive memory contents. This can aid attackers in bypassing address space layout randomization (ASLR) in long-running media processing services. A fix is available in commit 8670835.
Impact
Successful exploitation can lead to information disclosure by leaking uninitialized heap memory contents. This can help attackers bypass ASLR protections, which may facilitate further attacks. There is no indication of integrity or availability impact. No known exploits are reported in the wild.
Summary
The vulnerability in FFmpeg (libav) up to version 8.1.2 is an information disclosure issue in the LCL/ZLIB video decoder. When a zlib stream decompresses to fewer bytes than the expected frame size, the decompression function does not treat this as a fatal error and proceeds to copy the entire frame size worth of data from the allocation buffer. This behavior can leak uninitialized heap memory contents, potentially exposing sensitive data. This memory disclosure can assist attackers in bypassing ASLR protections in media processing environments. The issue is tracked as CVE-2026-66038 and has a CVSS 3.1 base score of 6.5 (medium severity). A patch fixing this vulnerability is available as of commit 8670835.
Weaknesses
References
- nvd.nist.gov/vuln/detail/CVE-2026-66038 (opens in a new tab)
- code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c (opens in a new tab)
- code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626 (opens in a new tab)
- vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c (opens in a new tab)
- ubuntu.com/security/CVE-2026-66038 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-66038 (opens in a new tab)
- ubuntu.com/security/notices/USN-8671-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8738-1 (opens in a new tab)