CVE-2026-18393

NameCVE-2026-18393
DescriptionA flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code execution.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ffmpeg (PTS)bullseye7:4.3.7-0+deb11u1vulnerable
bullseye (security)7:4.3.9-0+deb11u2vulnerable
bookworm, bookworm (security)7:5.1.9-0+deb12u1vulnerable
trixie (security), trixie7:7.1.5-0+deb13u1vulnerable
forky, sid7:8.1.2-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ffmpegsource(unstable)7:8.1.2-1

Notes

[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/242ff799c75f20bade946314c8d741d0887ee11c (n9.0)
Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/031fae5c41e6200d3d9b593339be724857b2aacd (n8.1.1)

Search for package or bug name: Reporting problems