Medium [CVE-2026-18393] Ffmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor via cur_fmt_mono cursor
This medium-severity Red Hat Linux advisory covers CVE-2026-18393 affecting Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI).
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data.
A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code execution. The ffmpeg package is not shipped in base Red Hat Enterprise Linux.
It is available through EPEL, Red Hat Enterprise Linux AI, and as a bundled dependency in Red Hat OpenShift AI container images. The vulnerable code resides in libavcodec (tdsc.c), which is compiled and shipped in all FFmpeg builds across these products.
The TDSC decoder is present since FFmpeg's initial inclusion of the codec in 2015. Red Hat severity: Moderate — CVSS 5.4 (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H).
Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
Red Hat does not currently list a fixing RHSA for this CVE.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- Avoid opening untrusted TDSC-encoded video content with vulnerable FFmpeg consumers until a patched version is available.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.