CVE-2026-125178 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's TDSC cursor decoder stores cursor dimensions before validating them, so a crafted AVI file can make it read past a heap buffer. An attacker can crash the decoder or leak heap memory into decoded frames.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg (libavcodec) to decode AVI files from untrusted sources, such as media-processing services, transcoders and upload pipelines. Teams that only process their own trusted media or do not decode TDSC content can skip it; the sources do not say more.
Not affected if no-tdsc-decoding, trusted-input-only
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -version, and compare it with the ranges in the NVD entry.FFmpeg through 9.0.2 contains an out-of-bounds heap read vulnerability in tdsc_load_cursor() in libavcodec/tdsc.c, which stores cursor dimensions before validating them. Attackers can supply a crafted AVI file with oversized TDSC cursor dimensions so tdsc_paint_cursor() reads past the cursor buffer, crashing the decoder or leaking heap memory into frames.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.