Bug 2508449

Summary:	CVE-2026-66038 ffmpeg: Information disclosure via malformed zlib video stream [fedora-43]
Product:	[Fedora] Fedora	Reporter:	Joel Chamberlain <jochambe>
Component:	ffmpeg	Assignee:	Multimedia SIG <multimedia-sig>
Status:	ASSIGNED ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	43	CC:	asn, development.group, dominik, multimedia-sig, ngompa13
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["453998c6-5862-46b8-abc0-54986ef4e902"]}
Fixed In Version:	ffmpeg-9.0.1-1.fc46,ffmpeg-9.0.1-4.fc45,ffmpeg-8.1.3-1.fc44	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Joel Chamberlain 2026-07-29 15:27:22 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.

Comment 1 Aoife Moloney 2026-08-17 15:40:24 UTC

This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.

Comment 2 Dominik 'Rathann' Mierzejewski 2026-09-29 08:07:31 UTC

Fixed in:
9.0:   https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/7c0b8c8594501dd904ebbb3b45bb3f6e2c745b7d
8.1.3: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/25867a16702756b261fee5d2c7b46f0d9aea94f0

NOT fixed in 7.1.x.

Comment 3 Fedora Update System 2026-09-29 08:07:50 UTC

FEDORA-2026-3e109a0c85 (ffmpeg-8.1.3-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e109a0c85

Comment 4 Fedora Update System 2026-10-01 01:11:56 UTC

FEDORA-2026-3e109a0c85 (ffmpeg-8.1.3-1.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.