CVE-2026-18393: Ffmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursor

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-28 · updated 2026-08-28
Weakness: CWE-787

Description

A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code execution.

Affected products

Red Hat Enterprise Linux AI (RHEL AI) 3: all versions
Red Hat OpenShift AI (RHOAI): all versions

References

https://access.redhat.com/security/cve/CVE-2026-18393
https://bugzilla.redhat.com/show_bug.cgi?id=2520309
https://github.com/FFmpeg/FFmpeg/commit/242ff799c75f20bade946314c8d741d0887ee11c
https://patchwork.ffmpeg.org/project/ffmpeg/patch/177767065817.63.1948165304485903849@29965ddac10e/

Get alerted when CVE-2026-18393 or the next vulnerability affects your stack