Bug 2520309 (CVE-2026-18393) - CVE-2026-18393 ffmpeg: ffmpeg: Heap buffer overflow in tdsc_load_cursor() via CUR_FMT_MONO cursor
Summary: CVE-2026-18393 ffmpeg: ffmpeg: Heap buffer overflow in tdsc_load_cursor() via...
Keywords:
Status: NEW
Alias: CVE-2026-18393
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2525512 2525513
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-20 13:27 UTC by OSIDB Bzimport
Modified: 2026-08-28 09:13 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-20 13:27:06 UTC 
FFmpeg contains a heap buffer overflow in libavcodec/tdsc.c, function
tdsc_load_cursor(), when processing CUR_FMT_MONO cursors. The mono path
advances dst by 4 * FFALIGN(cursor_w, 32) in the inner loops, then
incorrectly applies an additional row-end adjustment
(dst += ctx->cursor_stride - ctx->cursor_w * 4) copied from the BGRA/RGBA
branches. For cursor widths not divisible by 32, this drifts past the
allocation backing ctx->cursor. Present since the decoder's initial commit
(2015-03); fixed upstream in commit 242ff799c75f (2026-05-01), cherry-picked
to all active release branches. CWE-787.
Note You need to log in before you can comment on or make changes to this bug.