🚨 HIGH - FFmpeg TDSC decoder out-of-bounds write via crafted AVI (CVE-2026-65703) FFmpeg 2.7 through 8.1.2 is vulnerable to an out-of-bounds write in the TDSC video decoder when parsing TDSF frames inside AVI files. The root cause is improper memory management leading to a heap-based buffer overflow: tdsc_parse_tdsf() fails to unreference the existing reference frame before allocating a new buffer when frame dimensions change. An attacker can exploit this by delivering a crafted AVI that triggers dimension changes across TDSF frames, causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data past the end of an undersized heap buffer during decode. Impact ranges from heap corruption and denial of service (crash) to potential remote code execution in any application that decodes untrusted AVI content using FFmpeg. 👉 Affected: FFmpeg 2.7–8.1.2 | No fix yet - treat as suspicious
Post summary
The post announces a high-severity heap overflow in FFmpeg’s TDSC decoder via crafted AVI files, noting the lack of a fix but providing detailed technical and impact information.