CyberRota Analysis
AI-GeneratedThe vulnerability affects the FFmpeg LCL/ZLIB video decoder, allowing attackers to exploit uninitialized heap memory by providing a valid zlib stream that inflates to fewer bytes than expected. This can lead to information disclosure, as uninitialized data may be copied into the output, potentially compromising memory safety and defeating Address Space Layout Randomization (ASLR) in long-lived media processing services. Organizations using affected versions of FFmpeg, particularly those handling sensitive media data, should prioritize patching to mitigate this risk.
Original NVD Description
FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services.
Related CVEs
Other vulnerabilities affecting the same vendor(s)