CVE-2026-66038

FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlibdecomp functi...

CVE-2026-66038 FFmpeg LCL/ZLIB Video Decoder Information Disclosure via lcldec.c

FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlibdecomp functi...

mpv:fuzzer_set_property_MPV_FORMAT_STRING_1: Heap-use-after-free in av_frame_unref

Detailed Report: https://oss-fuzz.com/testcase?key=4909408073613312 Project: mpv Fuzzing Engine: afl Fuzz Target: fuzzersetpropertyMPVFORMATSTRING1 Job Type: aflasanmpv Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x515000039be0 Crash State: avframeunref avframefree...