Medium [CVE-2026-66038] Information disclosure via malformed zlib video stream
This medium-severity Red Hat Linux advisory covers CVE-2026-66038 affecting Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI).
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size.
The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.
A remote attacker could exploit this vulnerability by providing a specially crafted zlib stream that decompresses to a smaller size than expected. This can lead to the exposure of uninitialized heap memory, including sensitive data, which an attacker could observe in the AVFrame output.
This information disclosure could potentially aid in bypassing Address Space Layout Randomization (ASLR) in long-running media processing services. Our assessment reflects that this flaw strictly impacts Confidentiality with zero effect on Integrity or Availability (I:N, A:N).
It cannot be exploited to crash services, corrupt heap memory, or execute arbitrary code.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 11 days ago·verify at source
Mitigation checklist
- To mitigate this issue, services utilizing FFmpeg for LCL/ZLIB video stream decoding should avoid returning raw, decoded frame data to untrusted external endpoints. Implement robust input validation for all video streams processed by such services. Additionally, consider sandboxing FFmpeg processes that handle untrusted video content to limit potential information exposure.
Official advisory · high-confidence parse· fetched 11 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.