CVE-2026-65703 FFmpeg CVE debrief

Who should care

Users and administrators of FFmpeg versions 2.7 through 8.1.2 should be aware of this vulnerability, as it allows remote attackers to cause heap corruption by supplying a crafted AVI file. This vulnerability has a high impact due to its potential for code execution and process crashes. Affected operators, platforms, and security teams should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

The TDSC video decoder in FFmpeg versions 2.7 through 8.1.2 contains an out-of-bounds write vulnerability. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer. This results in heap corruption, leading to process crashes and potential code execution. The vulnerability can be exploited by supplying a crafted AVI file that changes frame dimensions across TDSF frames.

Defensive priority

High priority should be given to updating FFmpeg to a version that patches this vulnerability, as it could lead to process crashes and potential code execution. Defenders should also restrict access to AVI files from untrusted sources and monitor for suspicious AVI files being processed by FFmpeg.

Recommended defensive actions

• Update FFmpeg to a version that patches this vulnerability
• Restrict access to AVI files from untrusted sources
• Monitor for suspicious AVI files being processed by FFmpeg
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on this vulnerability. However, further analysis is limited by the availability of information. To verify, defenders should review the official CVE record and NVD entry for CVE-2026-65703. The vulnerability affects FFmpeg versions 2.7 through 8.1.2 and is caused by an out-of-bounds write in the TDSC video decoder. The impact of this vulnerability is heap corruption, which can lead to process crashes and potential code execution. Additional information can be found in the official advisory and CVE record.

Official resources