Medium [CVE-2026-66038] Information disclosure via malformed zlib video stream
This medium-severity Red Hat Linux advisory covers CVE-2026-66038 affecting Red Hat OpenShift AI 3.3, Red Hat Enterprise Linux AI (RHEL AI) 3.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Red Hat Linux publishes the next one.
See Red Hat Linux's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Summary
FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size.
The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.
A remote attacker could exploit this vulnerability by providing a specially crafted zlib stream that decompresses to a smaller size than expected. This can lead to the exposure of uninitialized heap memory, including sensitive data, which an attacker could observe in the AVFrame output.
This information disclosure could potentially aid in bypassing Address Space Layout Randomization (ASLR) in long-running media processing services. Our assessment reflects that this flaw strictly impacts Confidentiality with zero effect on Integrity or Availability (I:N, A:N).
It cannot be exploited to crash services, corrupt heap memory, or execute arbitrary code.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative. Check it before change work.
Official advisory · high-confidence parse· fetched 7 hours ago·verify at source
- 8.1.2
- rhoai/odh-vllm-gaudi-rhel9:1789121263
- RHSA-2026:73987
Official advisory · high-confidence parse· fetched 7 hours ago·verify at source
Mitigation checklist
- To mitigate this issue, services utilizing FFmpeg for LCL/ZLIB video stream decoding should avoid returning raw, decoded frame data to untrusted external endpoints. Implement robust input validation for all video streams processed by such services. Additionally, consider sandboxing FFmpeg processes that handle untrusted video content to limit potential information exposure.
Official advisory · high-confidence parse· fetched 7 hours ago·verify at source
More Red Hat Linux advisories
- CVE-2026-48710May 26, 2026Security restriction bypass via malformed HTTP Host header
- CVE-2026-42271May 8, 2026Authenticated command execution via MCP stdio test endpoints
- CVE-2026-119977Oct 31, 2026Arbitrary code execution via predictable upgrade staging paths
- CVE-2026-111497Oct 22, 2026Out-of-Bounds Write in Google Brotli Decoder
- CVE-2026-109619Oct 21, 2026fatal error handling retains stale request state leading to use-after-free
- CVE-2026-109618Oct 21, 2026OOM bailout during request parsing leads to memory corruption and RCE
iPhone and Android apps · New on the App Store
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.