VulnSocial

CVE-2026-66038Patch(ffmpeg / ffmpeg)

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch ffmpeg ffmpeg systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.

ffmpeg CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-908

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • ffmpeg

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 4 signals
  • Technical details provided in 4 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-07-24); latest day: 2
  • 4 total mentions across 2 days

Affected systems

Vendors
ffmpeg
Products
ffmpeg

Deep dive

Activity timeline4 mentions / 2d
01122Mentions · 2026-07-24: 2Mentions · 2026-07-28: 2Patch / Workaround · 2026-07-24: 2Patch / Workaround · 2026-07-28: 2Technical Details · 2026-07-24: 2Technical Details · 2026-07-28: 207-2407-28
Signal classification2 categories
Patch
375.0%
Disclosure
125.0%
Referenced assets2 URLs
By indicator
Classification over time
DateTotalLabels
2026-07-242
Disclosure1Patch1
2026-07-282
Patch2
Full discourse4 posts
  • Rıdvan Yağlı@ridvanyagli
    Patch

    🔴 FFmpeg'te 6 yeni önemli güvenlik açığı (CVE-2026-66036, CVE-2026-66037, CVE-2026-66038, CVE-2026-66039, CVE-2026-66040 ve CVE-2026-66041) keşfedildi. Açıklar; kötü amaçlı hazırlanmış video, ses, altyazı ve PNG dosyaları aracılığıyla bellek bozulmasına, hizmet reddine (DoS), bilgi sızıntısına ve bazı senaryolarda uzaktan kod çalıştırmaya (RCE) yol açabiliyor. FFmpeg 8.1.2 ve daha eski sürümler risk altında. FFmpeg'i yamalı sürüme, FFmpeg kullanan uygulamalarınızı ise en güncel sürüme yükseltin.

    Post summary

    Six critical FFmpeg vulnerabilities (CVE-2026-66036 to CVE-2026-66041) allow memory corruption, DoS, information leakage, and possible RCE via malicious media files; users are advised to update to patched or newer FFmpeg releases.

    00001152
    1.3K followersView on X
  • CVE@CVEnew
    Patch

    CVE-2026-66038 FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitia… https://www.cve.org/CVERecord?id=CVE-2026-66038

    Post summary

    The post reports an information‑disclosure flaw in FFmpeg’s LCL/ZLIB decoder, noting the fix via commit 8670835 and directing readers to the official CVE record.

    000101.6K
    57.9K followersView on X
  • TECHEPAGES@techepages
    Patch

    FFmpeg Security Advisory: Multiple high-severity vulnerabilities (CVSS up to 7.7) have been disclosed and patched upstream — organizations should update immediately and avoid processing untrusted media with risky filter configurations. 🔵 CVE-2026-66036 – Heap corruption via vf_hqdn3d filter 🔵 CVE-2026-66041 – Buffer overflow via vf_quirc/subtitle parsing 🔵 CVE-2026-66039 – Integer/heap overflow in MACE6 audio decoder 🔵 CVE-2026-66040 – Heap corruption in PNG/APNG encoder 🔵 CVE-2026-66037 – Memory exhaustion via IAMF demuxer 🔵 CVE-2026-66038 – Uninitialized memory disclosure in LCL/ZLIB decoder Recommended Action: Update FFmpeg to a version incorporating the upstream fixes (commits 5d7112c, 8670835, e7cbfd1, aafb5c6, b506faf, 4da9812).

    Post summary

    The advisory announces newly discovered high‑severity FFmpeg vulnerabilities that have already been patched, urging users to update to mitigate the risk.

    0000034
    35 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-66038 FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitia… https://www.cve.org/CVERecord?id=CVE-2026-66038 ----- Traducción: CVE-2026-66038 FFm… http://infoflow.cloud`

    Post summary

    CVE‑2026‑66038 is an information‑disclosure bug in FFmpeg’s LCL/ZLIB video decoder, fixed in commit 8670835, with no PoC or exploit details provided.

    0000069
    94 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appffmpegffmpeg---

Explore more

Back to dashboardffmpeg CVEsffmpeg vulnerabilities