CVE-2026-125178

Description

FFmpeg through 9.0.2 contains an out-of-bounds heap read vulnerability in tdsc_load_cursor() in libavcodec/tdsc.c, which stores cursor dimensions before validating them. Attackers can supply a crafted AVI file with oversized TDSC cursor dimensions so tdsc_paint_cursor() reads past the cursor buffer, crashing the decoder or leaking heap memory into frames.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24682 ↗
• https://github.com/FFmpeg/FFmpeg/commit/12c589a37d093cc55618f8377b092dc21416806f ↗
• https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/tdsc.c#L207 ↗
• https://github.com/FFmpeg/FFmpeg ↗
• https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-heap-read-via-tdsc-cursor-dimensions ↗