Skip to main content

FFmpeg CVE-2026-18393

| EUVDEUVD-2026-67655 MEDIUM
Out-of-bounds Write (CWE-787)
2026-08-28 redhat GHSA-2g8r-jjgv-h39x
Denial Of Service Memory Corruption RCE Buffer Overflow Red Hat Enterprise Linux Ai Rhel Ai 3 Red Hat Openshift Ai Rhoai Red Hat Suse
5.4
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
5.4 MEDIUM
AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
vuln.today AI
5.9 MEDIUM

File-based codec flaws are deliverable over the internet making AV:N more representative than AV:A; all other metrics preserved from vendor assessment.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
7.6 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Red Hat
5.4 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 28, 2026 - 12:09 vuln.today
Analysis Generated
Aug 28, 2026 - 12:09 vuln.today
CVE Published
Aug 28, 2026 - 09:05 cve.org
MEDIUM 5.4

DescriptionCVE.org

A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code execution.

AnalysisAI

Heap buffer overflow in FFmpeg's TDSC screen-capture codec decoder exposes Red Hat Enterprise Linux AI 3 and OpenShift AI deployments to denial of service or potential arbitrary code execution. The tdsc_load_cursor() function performs erroneous stride-based pointer arithmetic in two locations when rendering cursor data from crafted TDSC video, writing past a heap-allocated buffer boundary. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that a target process a specially crafted TDSC-encoded video file in which cursor dimension or stride fields are set to cause the pointer arithmetic `dst += ctx->cursor_stride - ctx->cursor_w * 4` to advance the destination pointer past the heap allocation boundary - this means the TDSC codec path, and specifically the cursor-loading subroutine, must be exercised during decoding. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 score of 5.4 (Medium) reflects a moderate baseline risk shaped by high attack complexity (AC:H) and required user interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The upstream fix is available in FFmpeg commit 242ff799c75f20bade946314c8d741d0887ee11c, which removes the erroneous pointer arithmetic from tdsc_load_cursor() in libavcodec/tdsc.c; a tagged upstream release version incorporating this fix is not confirmed from the available data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Red Hat Enterprise Linux Ai Rhel Ai 3

View all
CVE-2026-6859 HIGH
8.8 Apr 22

Remote code execution in InstructLab affects Red Hat Enterprise Linux AI 3 when users download or train models from Hugg
CVE-2026-6855 HIGH
7.1 Apr 22

Path traversal in InstructLab's chat session handler enables local authenticated attackers to write files to arbitrary f
CVE-2026-6385 MEDIUM
6.5 Apr 15

A remote attacker can trigger a heap out-of-bounds write in FFmpeg's DVD subtitle parser by providing a crafted MPEG-PS/
CVE-2026-12706 MEDIUM
6.5 Jun 19

Use-after-free in FFmpeg's RASC video decoder exposes Red Hat Enterprise Linux AI 3 and Red Hat OpenShift AI deployments
CVE-2026-12491 MEDIUM
4.8 Jun 17

Image input manipulation in vLLM's multimodal preprocessing pipeline allows remote, unauthenticated network attackers to

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected

Share

CVE-2026-18393 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy