CVE-2026-65703

Received Received - Intake

Heap Corruption in FFmpeg via TDSC Video Decoder

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description

FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-23

Generated

2026-07-24

AI Q&A

2026-07-24

EPSS Evaluated

N/A

NVD

CVE-2026-65703

EUVD

EUVD-2026-48370

Affected Vendors & Products

Vendor	Product	Version / Range
ffmpeg	ffmpeg	From 2.7 (inc) to 8.1.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is an out-of-bounds write vulnerability in FFmpeg versions 2.7 through 8.1.2 affecting the TDSC video decoder. Attackers can exploit it by providing a maliciously crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to remove references to existing frames before allocating new buffers, causing pixel data to be written beyond the intended buffer size. This leads to heap corruption, crashes, and potential arbitrary code execution.

Detection Guidance

To detect this vulnerability, monitor for crashes or memory corruption when processing AVI files with FFmpeg versions 2.7 through 8.1.2. Check FFmpeg version with 'ffmpeg -version'. Test suspicious files in a controlled environment to observe crashes or unexpected behavior.

Impact Analysis

If you process untrusted AVI files with vulnerable FFmpeg versions, an attacker could crash your application or execute malicious code on your system. This could lead to data theft, system compromise, or denial of service. The impact depends on how FFmpeg is used in your environment.

Mitigation Strategies

Immediately upgrade FFmpeg to a patched version beyond 8.1.2. If upgrading is not possible, disable the TDSC decoder by removing or renaming the relevant library files. Restrict access to media processing systems to trusted sources only.

Hi! I’m here to help you understand CVE-2026-65703. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70