Skip to main content

FFmpeg EUVDEUVD-2026-67655

| CVE-2026-18393 MEDIUM
Out-of-bounds Write (CWE-787)
2026-08-28 redhat GHSA-2g8r-jjgv-h39x
RCE Buffer Overflow Denial Of Service Memory Corruption Red Hat Red Hat Openshift Ai Rhoai Suse Red Hat Enterprise Linux Ai Rhel Ai 3 Red Hat
5.4
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
5.4 MEDIUM
AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
vuln.today AI
5.9 MEDIUM

File-based codec flaws are deliverable over the internet making AV:N more representative than AV:A; all other metrics preserved from vendor assessment.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
7.6 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Red Hat
5.4 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 28, 2026 - 12:09 vuln.today
Analysis Generated
Aug 28, 2026 - 12:09 vuln.today
CVE Published
Aug 28, 2026 - 09:05 cve.org
MEDIUM 5.4

DescriptionCVE.org

A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code execution.

AnalysisAI

Heap buffer overflow in FFmpeg's TDSC screen-capture codec decoder exposes Red Hat Enterprise Linux AI 3 and OpenShift AI deployments to denial of service or potential arbitrary code execution. The tdsc_load_cursor() function performs erroneous stride-based pointer arithmetic in two locations when rendering cursor data from crafted TDSC video, writing past a heap-allocated buffer boundary. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that a target process a specially crafted TDSC-encoded video file in which cursor dimension or stride fields are set to cause the pointer arithmetic `dst += ctx->cursor_stride - ctx->cursor_w * 4` to advance the destination pointer past the heap allocation boundary - this means the TDSC codec path, and specifically the cursor-loading subroutine, must be exercised during decoding. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 score of 5.4 (Medium) reflects a moderate baseline risk shaped by high attack complexity (AC:H) and required user interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The upstream fix is available in FFmpeg commit 242ff799c75f20bade946314c8d741d0887ee11c, which removes the erroneous pointer arithmetic from tdsc_load_cursor() in libavcodec/tdsc.c; a tagged upstream release version incorporating this fix is not confirmed from the available data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Red Hat Openshift Ai Rhoai

View all
CVE-2026-23536 HIGH POC
7.5 Mar 20

The Feast Feature Server contains a path traversal vulnerability in its `/read-document` endpoint that allows unauthenti
CVE-2026-18948 CRITICAL
9.9 Aug 10

Unauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions sto
CVE-2026-14450 CRITICAL
9.9 Aug 10

Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod alrea
CVE-2026-5483 CRITICAL
9.9 Apr 10

Kubernetes Service Account token disclosure in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) lets an authe
CVE-2026-15143 CRITICAL
9.3 Jul 10

Server-side request forgery in the file_type content detector of guardrails-detectors (a component shipped with Red Hat

CVE-2026-23537 CRITICAL
9.1 Jul 01

Arbitrary file write in the Feast Feature Server's `/save-document` endpoint lets an unauthenticated remote attacker wri
CVE-2026-18951 HIGH
8.8 Aug 10

Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage Tra
CVE-2026-18982 HIGH
8.8 Aug 10

Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or

CVE-2026-18617 HIGH
8.8 Aug 10

MySQL DSN parameter injection in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) allows a namespace editor
CVE-2026-18950 HIGH
8.8 Aug 10

Privilege escalation in odh-dashboard, the web interface for Red Hat OpenShift AI (RHOAI), allows any authenticated dash
CVE-2026-18949 HIGH
8.8 Aug 10

Privilege escalation in odh-dashboard (Red Hat OpenShift AI) allows an attacker who has obtained the dashboard's Service
CVE-2026-13717 HIGH
8.8 Aug 10

The MaaS (Model-as-a-Service) Gateway component in Red Hat OpenShift AI (RHOAI) is improperly configured, enabling any l

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected

Share

EUVD-2026-67655 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy