REDHAT-BUG-2520309: Buffer Overflow
FFmpeg contains a heap buffer overflow in libavcodec/tdsc.c, function tdscloadcursor(), when processing CURFMTMONO cursors. The mono path advances dst by 4 FFALIGN(cursorw, 32) in the inner loops, then incorrectly applies an additional row-end adjustment (dst += ctx->cursorstride - ctx->cursorw 4) copied from the BGRA/RGBA branches. For cursor widths not divisible by 32, this drifts past the allocation backing ctx->cursor. Present since the decoder's initial commit (2015-03); fixed upstream in commit 242ff799c75f (2026-05-01), cherry-picked to all active release branches. CWE-787.
Affected Software
Event History
Frequently Asked Questions
Which inputs trigger the vulnerable code path?
The issue occurs when FFmpeg processes CUR_FMT_MONO cursors whose widths are not divisible by 32. Those dimensions cause the cursor destination pointer to drift beyond the allocation.
How can I determine whether my FFmpeg build is affected?
Check whether the build includes upstream commit 242ff799c75f, dated 2026-05-01. The flaw was present from the decoder's initial commit in 2015-03 and was cherry-picked to all active release branches.