CVE-2026-18393: Out-of-bounds Write in Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3

This vulnerability involves an out-of-bounds write in the tdsc_load_cursor() function of FFmpeg's libavcodec when processing maliciously crafted TDSC cursor data. This heap buffer overflow (CWE-787) can be triggered remotely by supplying a specially crafted video file, potentially causing denial of service or enabling arbitrary code execution. The issue affects all FFmpeg builds that include the TDSC decoder, which has been part of FFmpeg since 2015. Red Hat packages FFmpeg in EPEL, RHEL AI, and OpenShift AI container images, making these products potentially affected. The vulnerability has a CVSS v3.1 score of 5.4 (medium severity) with an attack vector of adjacent network, high attack complexity, no privileges required, and user interaction required. Red Hat has not yet released a patch and recommends avoiding untrusted TDSC-encoded video content as a mitigation.

The vulnerability allows a remote attacker to cause a denial of service or potentially execute arbitrary code by providing a crafted video file containing malicious TDSC cursor data. This can lead to heap memory corruption, crashes, or unexpected behavior in affected FFmpeg consumers within Red Hat Enterprise Linux AI 3 and related products. The CVSS score of 5.4 reflects moderate impact with high attack complexity and user interaction required. There are no known exploits in the wild at this time.

Red Hat advises avoiding opening untrusted TDSC-encoded video content with vulnerable FFmpeg consumers until a patched version is available. No official fix or patch has been released yet. Users should monitor Red Hat advisories for updates and apply patches once they become available. No other vendor-recommended mitigations are provided at this time.