Description

A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-28T12:16:25.943Z",
  "pubdate": "2026-08-28T12:16:25.943Z",
  "executiveSummary": "A critical heap-based buffer overflow vulnerability exists within the FFmpeg multimedia framework, specifically residing in the tdsc_load_cursor() function.\nThis flaw is triggered when the application processes malformed TDSC cursor data contained within a maliciously crafted video file.\nSuccessful exploitation allows a remote attacker to induce memory corruption, which may result in a denial of service through process termination or the execution of arbitrary code under the context of the user running the FFmpeg process.\nThe vulnerability poses a significant risk to systems that automatically process untrusted video content, such as media transcoders, video streaming platforms, or browser-based media players.\nNo authentication is required for exploitation; the attack vector is realized once the vulnerable component parses the contaminated input stream.\nOrganizations are advised to prioritize updating FFmpeg to a patched version to neutralize the potential for remote code execution.",
  "technicalDetails": "The vulnerability originates from improper boundary validation within the tdsc_load_cursor() function during the parsing of TDSC (Time-Division Screen Capture) cursor data.\nThe function fails to adequately verify the size of the input data provided in the video file against the size of the heap-allocated destination buffer. When the input exceeds the pre-allocated memory segment, the routine performs an out-of-bounds write operation.\nExploitation is achieved by supplying a specially crafted video stream containing a malicious cursor payload. As the FFmpeg engine parses the TDSC header and payload, the insufficient bounds checking leads to a heap overflow.\nThis memory corruption can be leveraged to overwrite adjacent heap metadata, such as chunk headers or sensitive function pointers, depending on the memory layout at the time of execution.\nBy controlling the contents of the overflow, an attacker may influence the program's execution flow, potentially redirecting control to arbitrary code (e.g., shellcode) or causing an immediate crash of the application, leading to a denial of service.\nThe process involves the following attack flow: 1) The attacker delivers the malicious video file to the target system. 2) The victim application invokes the FFmpeg library to parse the file. 3) The tdsc_load_cursor() function is called to process the embedded cursor data. 4) The overflow condition is triggered due to the lack of length verification during the copy operation. 5) The heap is corrupted, leading to anomalous process behavior or attacker-controlled code execution.\nThis vulnerability is inherent to the media decoding pipeline, meaning it can be exploited by any service that exposes the TDSC decoder to user-supplied files. The impact is limited to the security context of the user process executing FFmpeg, although this often includes the ability to perform read/write operations or spawn processes on the host system."
}