CVE-2026-18393: Ffmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursor
A flaw was found in FFmpeg. The tdscloadcursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code execution.
Other sources
FFmpeg contains a heap buffer overflow in libavcodec/tdsc.c, function tdscloadcursor(), when processing CURFMTMONO cursors. The mono path advances dst by 4 FFALIGN(cursorw, 32) in the inner loops, then incorrectly applies an additional row-end adjustment (dst += ctx->cursorstride - ctx->cursorw 4) copied from the BGRA/RGBA branches. For cursor widths not divisible by 32, this drifts past the allocation backing ctx->cursor. Present since the decoder's initial commit (2015-03); fixed upstream in commit 242ff799c75f (2026-05-01), cherry-picked to all active release branches. CWE-787.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 242ff799c75f
Event History
Frequently Asked Questions
Which FFmpeg versions should be treated as potentially affected?
The flaw has been present since the TDSC decoder's initial commit in March 2015. Upstream fixed it in commit 242ff799c75f on 2026-05-01, and the fix was cherry-picked to all active release branches.
What input characteristics are relevant when assessing exposure?
The vulnerable path processes TDSC cursor data using CUR_FMT_MONO. The out-of-bounds write occurs for cursor widths that are not divisible by 32.
Does exploitation require attacker authentication or user interaction?
The CVSS vector indicates no privileges are required, but user interaction is required. The described delivery method is a remote attacker supplying a specially crafted video file.