CVE-2026-18393: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-18393 is a heap buffer overflow vulnerability in FFmpeg's tdsc_load_cursor() function within libavcodec/tdsc.c. When processing crafted TDSC cursor data (specifically CUR_FMT_MONO cursors), the function writes beyond the bounds of a heap-allocated buffer, potentially enabling denial of service or arbitrary code execution. The vulnerability has been present since FFmpeg's initial inclusion of the TDSC decoder in 2015 and was publicly disclosed on August 28, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) (Red Hat Advisory, Github Advisory).

The root cause is an out-of-bounds write (CWE-787) in libavcodec/tdsc.c. In the CUR_FMT_MONO processing path, the dst pointer is advanced by 4 * FFALIGN(cursor_w, 32) in inner loops, but an additional row-end stride adjustment (dst += ctx->cursor_stride - ctx->cursor_w * 4) — copied incorrectly from the BGRA/RGBA branches — is also applied. For cursor widths not divisible by 32, this causes the pointer to drift past the heap allocation backing ctx->cursor. Exploitation requires an attacker on an adjacent network to supply a specially crafted video file that a user opens, making both network adjacency and user interaction preconditions. The upstream fix (commit 242ff799c75f, dated 2026-05-01) removes the erroneous double stride adjustment and was cherry-picked to all active FFmpeg release branches (Red Hat Bugzilla, FFmpeg Commit).

Successful exploitation can cause a crash of the FFmpeg process (denial of service) or, in more severe cases, arbitrary code execution within the FFmpeg process context. There is no confidentiality impact, but integrity is partially affected (low) and availability is highly impacted. The vulnerability is scoped to the FFmpeg process itself, limiting lateral movement potential, though code execution in a media processing pipeline could expose adjacent systems or data handled by that pipeline (Red Hat Advisory, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is approximately 0.255% (17th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for adjacent network access, high attack complexity, and mandatory user interaction (Github Advisory, Red Hat Advisory).

1. Craft a malicious video file: Create a TDSC-encoded video file containing a CUR_FMT_MONO cursor with a width not divisible by 32, designed to trigger the double stride adjustment and overflow the heap buffer in tdsc_load_cursor().
2. Deliver the file to the target: Position the malicious file where a user on the adjacent network will open it — for example, via a shared network drive, media server, or social engineering (e.g., email attachment, download link accessible from the local network).
3. Trigger user interaction: Wait for or induce the target user to open the crafted video file with a vulnerable FFmpeg-based application (e.g., a media player, transcoder, or streaming tool).
4. Exploit the overflow: When FFmpeg decodes the TDSC cursor data, the out-of-bounds write corrupts heap memory adjacent to the ctx->cursor buffer, potentially causing a crash (DoS) or, with precise heap layout manipulation, redirecting execution flow for arbitrary code execution in the FFmpeg process context (Red Hat Bugzilla, FFmpeg Commit).

• Process: Unexpected crash or segmentation fault of FFmpeg or FFmpeg-based media player processes, particularly when processing TDSC-encoded video files.
• Logs: Application crash logs or core dumps referencing libavcodec/tdsc.c or the tdsc_load_cursor() function; error messages indicating heap corruption or out-of-bounds memory access.
• File System: Presence of unexpected or suspicious TDSC-encoded video files (.avi, .mkv, or other containers embedding TDSC streams) in shared directories or download folders.
• Network: Unusual file transfers of video content from adjacent network hosts to systems running FFmpeg-based applications, especially from untrusted or unknown sources.

The upstream fix is available in FFmpeg commit 242ff799c75f (merged 2026-05-01), which removes the erroneous double stride adjustment in tdsc_load_cursor() and has been cherry-picked to all active FFmpeg release branches. Users should update FFmpeg to a version containing this fix. As a workaround, Red Hat advises avoiding opening untrusted TDSC-encoded video content with vulnerable FFmpeg consumers until a patched version is deployed. Additionally, restricting user ability to open video files from untrusted or adjacent network sources and implementing application sandboxing can reduce the risk of exploitation (Red Hat Advisory, FFmpeg Commit).

Red Hat acknowledged the vulnerability and credited Seung Min Shin of Ajou University for discovering and reporting the issue, as well as providing the basis for the patch. Red Hat noted that the ffmpeg package is not shipped in base Red Hat Enterprise Linux but is available through EPEL, Red Hat Enterprise Linux AI, and as a bundled dependency in Red Hat OpenShift AI container images. No significant broader community or social media reactions have been observed beyond standard vulnerability database tracking (Red Hat Advisory).