FFmpeg CVE-2026-18393

Exploitation requires that a target process a specially crafted TDSC-encoded video file in which cursor dimension or stride fields are set to cause the pointer arithmetic dst += ctx->cursor_stride - ctx->cursor_w * 4 to advance the destination pointer past the heap allocation boundary - this means the TDSC codec path, and specifically the cursor-loading subroutine, must be exercised during decoding. Per the CVSS vector, the attacker must have adjacent network access (AV:A) to deliver the file to the target, and user interaction is required (UI:R), meaning a user or automated process must explicitly trigger FFmpeg to decode the crafted video. High attack complexity (AC:H) means reliable code execution requires favorable heap memory layout conditions beyond simple payload delivery. Environments that do not process TDSC-encoded video from adjacent or untrusted sources, or that use FFmpeg builds compiled without TDSC codec support, are not exposed to this vulnerability.

The CVSS 3.1 score of 5.4 (Medium) reflects a moderate baseline risk shaped by high attack complexity (AC:H) and required user interaction (UI:R). The CVSS attack vector AV:A (adjacent network) is unusual for a file-based codec flaw - file delivery is typically characterized as AV:N - and may reflect Red Hat's assessment of the specific deployment context where RHEL AI and RHOAI workloads process media streamed over local network segments rather than arbitrarily over the internet; defenders should verify this interpretation against their own deployment model. No EPSS data was available in the provided intelligence, so exploitation probability cannot be quantified. The absence of a KEV listing and no confirmed public proof-of-concept indicate this is not under broad active exploitation. However, CWE-787 heap overflows in media decoders have a well-established exploitation history; the high availability impact (A:H) makes reliable DoS the near-term realistic risk, while code execution remains plausible but constrained by AC:H conditions requiring favorable heap layout. The integrity impact (I:L) and absence of confidentiality impact (C:N per CVSS) suggest write capability is limited in practice. Overall, this is a real priority for environments processing untrusted TDSC video, but lower urgency than the RCE tag alone implies given AC:H and the niche codec involved.

An attacker positioned on the same network segment as a RHEL AI or RHOAI system delivers a specially crafted TDSC-encoded video file with manipulated cursor dimension or stride values to an automated AI/ML media processing pipeline or a user who opens the file with an FFmpeg-linked application. During decoding, tdsc_load_cursor() writes beyond the allocated heap buffer, reliably crashing the FFmpeg process as a denial of service; under favorable heap layout conditions achievable with significant attacker effort (AC:H), the overflow could redirect execution to attacker-supplied code. No public proof-of-concept exploit has been identified at time of analysis.