A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond
the bounds of a heap-allocated buffer when processing crafted TDSC cursor
data. A remote attacker could exploit this by supplying a specially crafted
video file, potentially leading to a denial of service or arbitrary code
execution.
Attack Parameters
Attack Vector
Adjacent
Requires local network access
Attack Complexity
High
Difficult to exploit
Privileges Required
None
No privileges needed
User Interaction
Required
User action required
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://access.redhat.com/security/cve/CVE-2026-18393
secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2520309
secalert@redhat.com
https://github.com/FFmpeg/FFmpeg/commit/242ff799c75f20bade946314c8d741d0887ee11c
secalert@redhat.com
https://patchwork.ffmpeg.org/project/ffmpeg/patch/177767065817.63.1948165304485…
secalert@redhat.com