CVE-2026-18393: Out-of-bounds Write in Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3

The vulnerability CVE-2026-18393 affects the tdsc_load_cursor() function in FFmpeg, specifically in the libavcodec component (tdsc.c). This function writes beyond the bounds of a heap-allocated buffer when processing maliciously crafted TDSC cursor data. The flaw can be exploited remotely by supplying a specially crafted video file, potentially causing a denial of service or enabling arbitrary code execution. The vulnerable code has been present since FFmpeg's initial inclusion of the TDSC codec in 2015 and is included in FFmpeg builds distributed via Red Hat Enterprise Linux AI, EPEL, and Red Hat OpenShift AI container images. Red Hat's advisory notes that the ffmpeg package is not part of base RHEL but is available through these channels. The CVSS v3.1 score assigned by Red Hat is 5.4 (medium), with attack vector as adjacent network, high attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. No official patch or remediation level is currently provided by Red Hat, and users should avoid opening untrusted TDSC-encoded video content until a fix is released.

The vulnerability allows a remote attacker to cause a denial of service by crashing the application processing the crafted video file or potentially execute arbitrary code due to heap buffer overflow. The integrity impact is low, availability impact is high, and confidentiality is not affected. Exploitation requires user interaction and access from an adjacent network. There are no known exploits in the wild at this time.

Red Hat advises avoiding opening untrusted TDSC-encoded video content with vulnerable FFmpeg consumers until a patched version is available. No official patch or fix has been released yet. Monitor Red Hat's advisory page for updates and apply patches once they become available.