Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

FFmpeg contains a heap buffer overflow in libavcodec/tdsc.c, function
tdsc_load_cursor(), when processing CUR_FMT_MONO cursors. The mono path
advances dst by 4 * FFALIGN(cursor_w, 32) in the inner loops, then
incorrectly applies an additional row-end adjustment
(dst += ctx->cursor_stride - ctx->cursor_w * 4) copied from the BGRA/RGBA
branches. For cursor widths not divisible by 32, this drifts past the
allocation backing ctx->cursor. Present since the decoder's initial commit
(2015-03); fixed upstream in commit 242ff799c75f (2026-05-01), cherry-picked
to all active release branches. CWE-787.