CVE-2026-18393: FFmpeg TDSC RCE Vulnerability

CVE-2026-18393 Overview

CVE-2026-18393 is a heap-based out-of-bounds write vulnerability in FFmpeg's TDSC (TechSmith Screen Codec 2) decoder. The tdsc_load_cursor() function in libavcodec/tdsc.c writes past the boundary of a heap-allocated buffer when parsing crafted TDSC cursor data inside a video file. A remote attacker who convinces a user to open a malicious video can trigger memory corruption. Successful exploitation may cause a denial of service or, under favorable conditions, arbitrary code execution in the context of the process using FFmpeg. The flaw is tracked as [CWE-787: Out-of-bounds Write].

Critical Impact
An adjacent-network attacker can corrupt heap memory in any application linked against vulnerable FFmpeg by delivering a crafted TDSC-encoded video, enabling denial of service and potential code execution.

Affected Products

FFmpeg (libavcodec/tdsc.c TDSC decoder) prior to commit 242ff799c75f20bade946314c8d741d0887ee11c
Linux distributions redistributing vulnerable FFmpeg builds (see Red Hat CVE-2026-18393 Advisory)
Applications and media pipelines statically or dynamically linked against affected libavcodec versions

Discovery Timeline

2026-08-28 - CVE-2026-18393 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-18393

Vulnerability Analysis

The TDSC decoder in FFmpeg reconstructs mouse cursor bitmaps embedded in TechSmith-encoded screen recordings. During cursor decoding, tdsc_load_cursor() iterates over pixel rows and advances a destination pointer using both a per-row stride and an additional stride correction. The correction is applied twice, causing the write pointer to drift beyond the end of the allocated cursor buffer. On crafted input where cursor_stride and cursor_w values maximize the drift, the function writes attacker-influenced bytes into adjacent heap memory.

The corruption primitive is a linear heap out-of-bounds write with attacker-controlled content and length bounded by the declared cursor dimensions. Heap grooming through preceding allocations in libavcodec may allow overwriting function pointers or object metadata in neighboring chunks. Exploitation requires user interaction to open the malicious file and an adjacent-network position to deliver it, for example through a shared streaming service or LAN media source.

Root Cause

The destination pointer dst was adjusted by ctx->cursor_stride - ctx->cursor_w * 4 at the end of each row, while the inner loop already advanced dst by the row length. This double stride adjustment shifted writes past the buffer boundary. The fix removes the redundant adjustment so that stride handling occurs exactly once per row.

Attack Vector

An attacker crafts a container file (for example AVI or MOV) carrying a TDSC video track with malformed cursor metadata. When a victim application decodes the stream through FFmpeg on an adjacent network, tdsc_load_cursor() performs the out-of-bounds write. No authentication is required, but the victim must open or preview the file.

// Security patch in libavcodec/tdsc.c (excerpt)
// avcodec/tdsc: remove double stride adjustment
                     bits <<= 1;
                 }
             }
-            dst += ctx->cursor_stride - ctx->cursor_w * 4;
         }
 
         dst = ctx->cursor;
// Source: https://github.com/FFmpeg/FFmpeg/commit/242ff799c75f20bade946314c8d741d0887ee11c

Detection Methods for CVE-2026-18393

Indicators of Compromise

Crashes or segmentation faults in processes linked against libavcodec while decoding AVI, MOV, or other containers carrying TDSC (TSC2) video streams
Presence of untrusted media files with TDSC codec tags arriving from adjacent-network sources such as SMB shares, AirPlay, or Chromecast relays
AddressSanitizer or Valgrind reports referencing tdsc_load_cursor in libavcodec/tdsc.c

Detection Strategies

Inspect installed FFmpeg builds and confirm whether they include the fix commit 242ff799c75f20bade946314c8d741d0887ee11c or a vendor backport
Deploy file-type inspection at network and email gateways to flag media files declaring TDSC (TSC2) codec identifiers from untrusted senders
Enable heap protection instrumentation (glibc MALLOC_CHECK_, hardened allocator) on media transcoding servers to surface out-of-bounds writes early

Monitoring Recommendations

Alert on repeated abnormal terminations of media-processing services such as transcoders, thumbnailers, and screen-share ingest workers
Log and correlate FFmpeg command-line invocations that process files sourced from adjacent-network shares or user uploads
Collect crash dumps from endpoints and route them to a central data lake for stack-trace analysis referencing libavcodec/tdsc.c

How to Mitigate CVE-2026-18393

Immediate Actions Required

Update FFmpeg to a build that incorporates upstream commit 242ff799c75f20bade946314c8d741d0887ee11c or the equivalent distribution patch
Apply vendor updates from downstream packagers listed in the Red Hat CVE-2026-18393 Advisory
Audit third-party applications that statically bundle libavcodec and rebuild them against a patched source tree

Patch Information

The upstream fix removes the duplicate stride adjustment in tdsc_load_cursor(). Review the change in the GitHub FFmpeg Commit 242ff799 and the corresponding FFmpeg Patch Submission. Distribution tracking is available at Red Hat Bugzilla #2520309.

Workarounds

Disable the TDSC decoder at build time with --disable-decoder=tscc2 if TechSmith screen recordings are not required
Restrict FFmpeg processing of untrusted media to sandboxed workers with seccomp, bwrap, or container isolation to contain heap corruption
Block ingestion of media files carrying the TSC2 FourCC at email and web gateways until patched builds are deployed

bash

# Rebuild FFmpeg without the vulnerable decoder
./configure --disable-decoder=tscc2
make -j$(nproc)
make install

# Verify installed version includes the fix commit
ffmpeg -version
git -C /path/to/FFmpeg log --oneline | grep 242ff799