CVE-2026-65703

Name of the Vulnerable Software and Affected Versions FFmpeg versions 2.7 through 8.1.2

Description An out-of-bounds write issue exists in the TDSC video decoder. A remote attacker can cause heap corruption by providing a specially crafted AVI file that alters frame dimensions across TDSF frames. The tdsc parse tdsf() function does not unreference the current reference frame before calling av frame get buffer(). This leads the tdsc blit() and tdsc yuv2rgb() functions to write attacker-controlled pixel data beyond the boundaries of the undersized reference frame buffer, which can result in a process crash or potential arbitrary code execution.

Recommendations Update FFmpeg to a version later than 8.1.2.