Threats Tagged 'ghsa-8mx4-8xfc-qr43'

FFmpeg versions through 8.1.2 contain an information disclosure vulnerability in the LCL/ZLIB video decoder. This flaw allows attackers to expose uninitialized heap memory by providing a valid zlib stream that decompresses to fewer bytes than the expected frame size. The vulnerability arises because the decompression function treats short decompression as non-fatal and copies a full frame's worth of data from the allocation buffer, potentially leaking sensitive memory contents. This can aid attackers in bypassing address space layout randomization (ASLR) in long-running media processing services. A fix is available in commit 8670835.