CVE-2026-125178: FFmpeg through 9.0.2 Out-of-Bounds Heap Read via TDSC Cursor Dimensions

Q: What must an attacker provide to trigger this issue?

An attacker must get the affected FFmpeg decoder to process a crafted AVI file containing oversized TDSC cursor dimensions. User interaction is required, such as opening or otherwise decoding the malicious file.

Q: What impact can successful exploitation have?

The out-of-bounds read can crash the decoder, causing a denial of service. It may also cause heap memory to be incorporated into decoded frames, potentially disclosing memory contents.

Q: Which deployments are exposed?

Deployments that use FFmpeg through 9.0.2 to decode AVI files with TDSC cursor data are affected. The supplied information does not identify any configuration setting that disables the affected parsing path by default.

Q: What can be done before an update is applied?

Avoid decoding untrusted AVI files, particularly where files may contain TDSC cursor data. Restricting access to media-processing workflows and isolating FFmpeg decoding can reduce exposure to crashes and potential memory disclosure.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an out-of-bounds heap read vulnerability in tdscloadcursor() in libavcodec/tdsc.c, which stores cursor dimensions before validating them. Attackers can supply a crafted AVI file with oversized TDSC cursor dimensions so tdscpaintcursor() reads past the cursor buffer, crashing the decoder or leaking heap memory into frames.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker provide to trigger this issue?

An attacker must get the affected FFmpeg decoder to process a crafted AVI file containing oversized TDSC cursor dimensions. User interaction is required, such as opening or otherwise decoding the malicious file.

What impact can successful exploitation have?

The out-of-bounds read can crash the decoder, causing a denial of service. It may also cause heap memory to be incorporated into decoded frames, potentially disclosing memory contents.

Which deployments are exposed?

Deployments that use FFmpeg through 9.0.2 to decode AVI files with TDSC cursor data are affected. The supplied information does not identify any configuration setting that disables the affected parsing path by default.

What can be done before an update is applied?

Avoid decoding untrusted AVI files, particularly where files may contain TDSC cursor data. Restricting access to media-processing workflows and isolating FFmpeg decoding can reduce exposure to crashes and potential memory disclosure.

CVE-2026-125178: FFmpeg through 9.0.2 Out-of-Bounds Heap Read via TDSC Cursor Dimensions

Affected Software

Event History

Frequently Asked Questions

What must an attacker provide to trigger this issue?

What impact can successful exploitation have?

Which deployments are exposed?

What can be done before an update is applied?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger this issue?

What impact can successful exploitation have?

Which deployments are exposed?

What can be done before an update is applied?