CVE-2026-65703

EUVD-2026-48370

23.07.2026, 20:17

FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 20.28%

Affected Products (NVD)

Vendor	Product	Version
ffmpeg	ffmpeg	2.7 ≤ 𝑥 ≤ 8.1.2

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ffmpeg

bookworm	vulnerable
bookworm (security)	vulnerable
forky	7:9.0.2-3 fixed
sid	7:9.0.2-4 fixed
trixie	postponed
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

ffmpeg

bionic	Fixed 7:3.4.11-0ubuntu0.1+esm15 released
focal	Fixed 7:4.2.7-0ubuntu0.1+esm16 released
jammy	Fixed 7:4.4.2-0ubuntu0.22.04.1+esm15 released
noble	Fixed 7:6.1.1-3ubuntu5+esm13 released
resolute	Fixed 7:8.0.1-3ubuntu2+esm4 released
xenial	Fixed 7:2.8.17-0ubuntu0.1+esm17 released

libav

jammy	dne
noble	dne
resolute	dne
trusty	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

libavcodec-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavcodec57

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libavcodec58_134

suse enterprise desktop 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.55.1 fixed

libavformat-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavformat57

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavformat58_76

suse enterprise desktop 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.55.1 fixed

libavresample-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavresample3

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavutil-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libavutil55

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libavutil56_70

suse enterprise desktop 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.55.1 fixed

libpostproc-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libpostproc54

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libpostproc55_9

suse enterprise sap 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.75.1 fixed

libswresample-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswresample2

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswresample3_9

suse enterprise desktop 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.55.1 fixed

libswscale-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswscale4

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswscale5_9

suse enterprise desktop 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise sap 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise sap 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise server 15 SP4	4.4.8-150400.3.75.1 fixed
suse enterprise server 15 SP7	4.4.8-150600.13.55.1 fixed
suse enterprise workstation 15 SP7	4.4.8-150600.13.55.1 fixed

Common Weakness Enumeration

CWE-787 - Out-of-bounds Write
The software writes data past the end, or before the beginning, of the intended buffer.

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773

https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder