FFmpeg releases up to and including version 8.1.2 contain a flaw in the LCL/ZLIB video decoder that can leak uninitialized heap memory. When a supplied zlib stream inflates to fewer bytes than the declared frame size, the decoder treats the short decompression as non‑fatal and proceeds to the RGB24 conversion path. This path copies a full frame’s worth of rows from the allocation buffer using the original frame dimensions, causing uninitialized heap contents—including pointer‑derived allocator bytes—to be copied into the resulting AVFrame output, thereby exposing raw memory to the attacker. The vulnerability aligns with CWE‑908, Information Exposure Through Uninitialized Memory, and can undermine ASLR protection in long‑running media processing services.

The vulnerability affects FFmpeg builds through version 8.1.2. The issue was fixed in a later commit (8670835). Users should verify that their FFmpeg version includes the referenced commit before assuming it is safe.

The CVSS score of 7.1 indicates a moderate severity vulnerability. The EPSS score of <1% suggests a very low likelihood of exploitation in the wild, and there is no listing in the CISA KEV catalog. The flaw requires an attacker to supply a crafted media file to a process that utilizes FFmpeg’s LCL/ZLIB decoder, meaning the impact is most pronounced in services that receive untrusted video input. The vulnerability does not provide remote code execution but does allow confidentiality compromise and potential ASLR bypass in persistent services.