CVE-2026-65703 in FFmpeg
Summary
by MITRE • 07/23/2026
FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability under discussion represents a critical out-of-bounds write flaw within FFmpeg's TDSC video decoder component affecting versions ranging from 2.7 through 8.1.2. This security weakness stems from improper handling of reference frames during video decoding operations, specifically when processing TDSF (Temporal Difference SFrame) frames within AVI container files. The flaw manifests when attackers craft malicious AVI files that manipulate frame dimensions across successive TDSF frames, creating a scenario where the decoder's memory management becomes compromised.
The technical root cause lies in the tdsc_parse_tdsf() function implementation which fails to properly unreference existing reference frames before invoking av_frame_get_buffer(). This critical oversight creates a race condition where subsequent decoding operations attempt to write pixel data into buffers that are insufficiently sized for the incoming frame dimensions. The vulnerability specifically targets the memory allocation pattern used by FFmpeg's video decoder, where reference frames are pre-allocated based on initial frame parameters but may be subsequently resized without proper buffer reallocation or validation.
When the tdsc_blit() and tdsc_yuv2rgb() functions execute with these improperly managed reference frames, they perform memory operations that extend beyond the originally allocated buffer boundaries. The heap corruption occurs as attacker-controlled pixel data is written past the end of the undersized reference frame buffer, causing unpredictable memory corruption patterns. This memory corruption leads to immediate process crashes due to segmentation faults or access violations, but more critically can potentially enable remote code execution through carefully crafted memory overwrite scenarios that may allow attackers to manipulate program control flow.
The operational impact of this vulnerability extends beyond simple denial-of-service conditions, as it represents a potential remote code execution vector that could be exploited by malicious actors. The vulnerability's exploitability is enhanced by the widespread use of FFmpeg in multimedia applications, streaming platforms, and content processing systems, making numerous endpoints potentially accessible to attackers. Security researchers have classified this issue under CWE-787: "Out-of-bounds Write" which specifically addresses memory safety violations where programs write data beyond allocated buffer boundaries.
From an adversarial perspective, this vulnerability aligns with ATT&CK tactic T1203: "Exploitation for Client Execution" and may be leveraged as part of broader attack chains targeting multimedia processing pipelines. The vulnerability's characteristics make it particularly attractive for exploitation in scenarios involving untrusted media file handling, such as web browsers, media players, or content management systems that utilize FFmpeg for video processing. The memory corruption pattern suggests potential for advanced exploit techniques including heap spraying or return-oriented programming attacks that could leverage the predictable buffer overflow conditions.
Organizations should prioritize immediate patching of affected FFmpeg installations and implement additional security controls such as input validation for multimedia files, sandboxing of media processing components, and network segmentation to limit potential attack surface exposure. The vulnerability highlights the critical importance of proper memory management in multimedia decoders and underscores the need for comprehensive security testing of video processing libraries that handle untrusted input data streams.