Description
FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.
Published: 2026-07-23
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

FFmpeg versions 2.7 through 8.1.2 contain an out‑of‑bounds write in the TDSC video decoder. The vulnerability arises when an attacker supplies a specially crafted AVI file that changes frame dimensions across TDSF frames. During decoding, the tdsc_parse_tdsf() function fails to release the existing reference frame before allocating a new buffer. This causes tdsc_blit() and tdsc_yuv2rgb() to write pixel data beyond the end of the undersized reference frame buffer, leading to heap corruption, process crashes, and potentially remote code execution. The flaw is classified as CWE‑787.

Affected Systems

FFmpeg binaries that include the TDSC decoder, specifically releases 2.7 through 8.1.2. Any application or service that uses these builds to process AVI files is affected.

Risk and Exploitability

The CVSS score of 8.5 denotes high severity, but the EPSS score of less than 1% indicates the likelihood of exploitation is currently low. The vulnerability is exploitable remotely by providing a malicious AVI file to any software that invokes FFmpeg's TDSC decoder. The attack requires the ability to influence the input stream; once triggered, heap corruption can lead to a crash or arbitrary code execution.

Generated by OpenCVE AI on August 3, 2026 at 21:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FFmpeg to a release newer than 8.1.2, such as 8.1.3 or later, to apply the vendor fix.
  • If an upgrade is not feasible, rebuild or configure FFmpeg without enabling the TDSC decoder so the vulnerable code cannot be executed.
  • Add strict validation of incoming AVI files, ensuring that frame dimensions remain constant across TDSF frames, and reject or refuse to decode files that violate this rule.

Generated by OpenCVE AI on August 3, 2026 at 21:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*

Sat, 25 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 24 Jul 2026 00:30:00 +0000

Type Values Removed Values Added
First Time appeared Ffmpeg
Ffmpeg ffmpeg
Vendors & Products Ffmpeg
Ffmpeg ffmpeg

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.
Title FFmpeg 2.7 - 8.1.2 Out-of-Bounds Write in TDSC Video Decoder
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Subscriptions

Ffmpeg Ffmpeg
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-28T01:06:11.716Z

Reserved: 2026-07-22T20:26:09.980Z

Link: CVE-2026-65703

cve-icon Vulnrichment

Updated: 2026-07-23T19:29:30.316Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-23T20:17:21.803

Modified: 2026-08-07T00:19:03.283

Link: CVE-2026-65703

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-23T18:52:19Z

Links: CVE-2026-65703 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T21:15:04Z

Weaknesses