Executive brief
FFmpeg is a multimedia framework used to process video and audio files across many applications and services. A flaw in its TDSC cursor decoder allows an attacker to cause a heap buffer overflow by supplying a specially crafted video file, potentially leading to service crashes or arbitrary code execution on systems that process untrusted video content.
Technical details
A heap buffer overflow exists in FFmpeg's tdsc_load_cursor() function within libavcodec (tdsc.c) when processing crafted TDSC cursor data. The vulnerability arises from improper bounds checking during the parsing of cursor format data (specifically CUR_FMT_MONO), allowing writes beyond allocated buffer boundaries. The attack vector is adjacent network or local, triggered by a remote attacker supplying a specially crafted TDSC-encoded video file; user interaction is required to process the malicious content. An attacker can achieve denial of service via crash or, in some scenarios, arbitrary code execution through memory corruption. Patches are available from the FFmpeg project (commit 242ff799c75f20bade946314c8d741d0887ee11c).
Affected products
- FFmpeg FFmpeg Since 2015 (initial TDSC codec inclusion)
Timeline
- 2026-08-28: disclosed
- 2026: patched: Patch available as commit 242ff799c75f20bade946314c8d741d0887ee11c