CVE-2026-65703

Executive Summary

CVE-2026-65703 is a high-severity heap out-of-bounds write vulnerability in the FFmpeg TDSC video decoder, affecting all versions from 2.7 through 8.1.2. The flaw is triggered when a remote attacker supplies a crafted AVI file that changes frame dimensions across TDSF frames, leading to heap corruption, potential process crash, and possible code execution on the target system. Successful exploitation requires user interaction (e.g., opening a malicious media file), but given FFmpeg's ubiquity in media processing pipelines, video players, and server-side transcoding services, the attack surface is broad.

Technical Analysis

The vulnerability resides in the TDSC video decoder component within FFmpeg. The core mechanism is an out-of-bounds write (CWE-787) that occurs during the handling of TDSF frames within an AVI container. The NVD description identifies specific code paths involved in the flaw.

The root cause is a failure in the tdsc_parse_tdsf() function to unreference an existing reference frame before calling av_frame_get_buffer(). In normal operation, when a video decoder receives a new frame, it must release references to the previously decoded frame buffer before allocating a new buffer, ensuring that memory is appropriately sized for the incoming frame's dimensions. Because tdsc_parse_tdsf() skips this unreferencing step, the subsequent buffer allocation does not resize or reallocate memory to match the new frame dimensions. When an attacker crafts an AVI file that changes frame dimensions across successive TDSF frames, the decoder attempts to write pixel data into an undersized buffer.

The subsequent operations, tdsc_blit() and tdsc_yuv2rgb(), then perform memory write operations with attacker-controlled pixel data. Because these functions assume the buffer has the expected dimensions for the decoded frame, they write beyond the boundary of the undersized reference frame buffer. This results in heap corruption, which can manifest as a process crash or, if carefully manipulated, arbitrary code execution. The vulnerability is local in the sense that the attack vector requires the victim to process a malicious file, but the payload delivery is typically remote (e.g., via a website, email attachment, or a compromised server-side transcoding pipeline).

The attack surface includes any application that uses FFmpeg libraries to decode AVI files with TDSC video codec support. This includes client-side media players, but also—significantly—server-side applications such as video streaming platforms, media servers, and transcoding services that automatically process user-uploaded files. The vulnerability is scored 7.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating that while local access and user interaction are required, the impacts on confidentiality, integrity, and availability are all high.

Exploitation Scenarios

The attack chain for CVE-2026-65703 does not require a public PoC, but follows a deterministic technical path based on the vulnerability mechanics.

1. Reconnaissance/Identification: An attacker targets any platform that ingests untrusted media files. Targets include: enterprises running FFmpeg-based transcoding servers, web application backends that convert video uploads, digital asset management systems, or end-user workstations with media players that bundle FFmpeg libraries. The attacker need not identify the specific FFmpeg version; they can craft the malicious file to target the broad affected range (2.7 through 8.1.2).

2. Trigger/Weaponization: The attacker crafts a malicious AVI file containing a sequence of TDSF frames. The file is engineered with a specific property: the frame dimensions (width and height) change between successive TDSF frames. This dimension change is the critical trigger. When the file is parsed, the initial TDSF frame allocates a buffer based on the first frame's dimensions. Because tdsc_parse_tdsf() fails to unreference the buffer before the next allocation, the next frame's dimensions—being larger—cause the decoder to write pixel data into the undersized buffer. The attacker controls the pixel data (the raw compressed pixel payload) encoded in the subsequent TDSF frame.

3. Payload/Execution: The malicious AVI is delivered to the target. Delivery vectors include: a link to a website, an email attachment, a direct upload to a web application, or placement in a network-accessible shared folder. When the target application (e.g., a media player, a transcoder daemon, or a web app's video processing module) opens the file, the FFmpeg library parses the AVI container, identifies the TDSC codec, and begins decoding. The dimension change in the crafted file causes the out-of-bounds write in tdsc_blit() and tdsc_yuv2rgb(). The attacker-controlled pixel data overwrites adjacent heap allocations. The attacker crafts the pixel payload to overwrite critical heap metadata (e.g., malloc chunk headers) or adjacent object pointers, escalating the primitive from a crash to arbitrary code execution. In the event of a crash, this is a denial-of-service; in the controlled case, the attacker achieves remote code execution with the privileges of the FFmpeg process.

4. Post-Exploitation Impact: If code execution is achieved, the attacker gains the privileges of the FFmpeg process. In a server environment (e.g., a transcoding service), this may be a low-privileged service account, but it can be leveraged for lateral movement or further exploitation. On a client workstation, this could mean user-level code execution, leading to data exfiltration, credential theft, or installation of persistence mechanisms. The confidentiality, integrity, and availability impacts are all rated High in the CVSS score, reflecting the potential for severe compromise.

Impact Assessment

The business impact of CVE-2026-65703 is significant due to FFmpeg's adoption rate. FFmpeg is the de facto multimedia framework, used by thousands of applications, including major video players (VLC, which bundles FFmpeg), web browsers (Chrome, Firefox for media parsing), and enterprise media infrastructure (transcoding clusters, live streaming platforms). The affected version range spans nearly a decade of releases (from FFmpeg 2.7 to 8.1.2), meaning the overwhelming majority of deployed FFmpeg installations are vulnerable.

Blast radius: The vulnerability is exploitable via any file ingestion path. For enterprises, the most critical risk is in server-side media processing pipelines. If a web application accepts user uploads and transcodes them server-side, an attacker can submit the malicious AVI directly, triggering the vulnerability without any intermediate user interaction. This elevates the risk beyond simple user-interaction exploitation. The CVSS vector (AV:L/AC:L/PR:N/UI:R) technically scores it as local with user interaction, but in server-side auto-processing contexts, the "user interaction" is the automated ingestion process, effectively reducing the victim engagement.

The EPSS score is 0.00207 (10.9% percentile), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in CISA KEV, and there is no known exploit code or public PoC. However, the patch confidence is low (2/4, "CLAIMED"), meaning the fix is reported but not independently verified. This suggests that if the patch is absent, the window for exploitation remains open for an extended period.

Detection Guidance

Sigma Rule

title: CVE-2026-65703 FFmpeg TDSC Decoder Out-of-Bounds Write
id: 3f4a9c21-vvvv-4d1e-9a2b-5c6d7e8f9a0b
status: experimental
description: Detects crashes or abnormal termination in processes using FFmpeg libraries, which may indicate exploitation of the TDSC decoder vulnerability.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-65703
author: Valtersit Threat Intelligence
date: 2024/07/10
logsource:
    category: process_creation
    product: windows
detection:
    selection_crash:
        EventID: 1000  # Application Error (Windows)
        Image|endswith:
            - '\ffmpeg.exe'
            - '\ffplay.exe'
            - '\ffprobe.exe'
            - '\vlc.exe'
    selection_fault:
        FaultingModule|contains: 'avcodec'
    condition: selection_crash and selection_fault
falsepositives:
    - Legitimate crashes due to other malformed media files
    - Memory pressure-related failures in high-load systems
level: high
tags:
    - attack.t1203
    - cve.2026-65703
    - cwe.787

YARA Rule

rule CVE_2026_65703_TDSC_AVI_Exploit
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects AVI files with TDSC frames and dimension changes indicative of CVE-2026-65703 exploitation attempts."
        date = "2024-07-10"
        cve = "CVE-2026-65703"
        severity = "high"
    strings:
        $tdsc_fourcc = "TDSC" ascii
        $avi_header = "AVI " ascii
        $hdrl = "hdrl" ascii
        $strh = "strh" ascii
        $strf = "strf" ascii
        // Pattern for a video stream header with changing dimensions:
        // In the 'strh' structure, the width and height fields (rcFrame) at offset 32-39
        // In 'strf' BITMAPINFOHEADER, width and height at offset 4-11
        $dim_w1 = { ?? ?? 00 00 } // placeholder for width
    condition:
        $tdsc_fourcc and $avi_header and $hdrl and $strh and $strf and uint32(0) == 0x46464952
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-65703 FFmpeg TDSC AVI File Transfer Attempt"; flow:to_server; filemagic:"RIFF"; fileext:"avi"; content:"TDSC"; distance:0; within:100; content:"avih"; distance:0; within:50; content:"strh"; distance:0; within:50; classtype:attempted-user; sid:202665703; rev:1; reference:cve,2026-65703;)

Note: This rule detects network transfers of AVI files containing TDSC codec identifiers. It may require a file_data inspection engine capability.

Elastic Detection

// Elastic EQL query to detect FFmpeg process crashes with avcodec module faults
process where process.name in ("ffmpeg.exe", "ffplay.exe", "vlc.exe") and event.code == 1000 and process.args : ("*.avi", "*.AVI")

Note: This EQL likely needs to be paired with a Windows Event Log integration for Application Error events.

Splunk SPL Query

index="windows" source="WinEventLog:Application" EventCode=1000
| rex field=Message "Faulting application name: (?<app_name>[^,]+)"
| where app_name IN ("ffmpeg.exe", "ffplay.exe", "vlc.exe")
| rex field=Message "Faulting module name: (?<module_name>[^,]+)"
| where like(module_name, "%avcodec%")
| stats count by host, app_name, module_name
| sort -count

Wazuh OSSEC Rule

<group name="media_processing,">
  <rule id="207331" level="12">
    <if_sid>571</if_sid>
    <match>Faulting application name: ffmpeg.exe</match>
    <description>CVE-2026-65703: FFmpeg process crash (TDSC decoder OOB write suspected).</description>
    <group>attack.t1203,cve.2026-65703,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate Mitigations:

   • File-based filter: If you control a media ingestion pipeline, implement a file-type whitelist or filename extension filter to block .avi files if TDSC is not a legitimate required codec. This is an extenuating and temporary measure.
   • Sandboxing: If FFmpeg is used for transcoding, run the process in a restricted sandbox (e.g., gVisor, Firecracker, SELinux/AppArmor) to contain the impact of a potential code execution.
   • Disable TDSC decoder: If the TDSC codec is not required for your legal media content, compile FFmpeg with --disable-decoder=tdsc to remove the vulnerable decoder entirely. This is the most effective immediate mitigation.
   • Input validation: If possible, inspect incoming AVI files for frame dimension changes across streams before processing, though this is complex and not fully reliable.

2. Patch/Upgrade Steps:

   • The NVD description implies the existence of a fix in a version later than 8.1.2. Upgrade FFmpeg to the latest stable release (e.g., 8.1.3 or newer, or the current LTS release if applicable).
   • For binary distributions (Linux distros, Windows builds), apply the vendor's security update. For package-managed systems, use the appropriate tool: apt-get update && apt-get upgrade ffmpeg (Debian/Ubuntu), yum update ffmpeg (RHEL), or check for the latest static build on ffmpeg.org.
   • Action: Verify your version: ffmpeg -version. If your version is <= 8.1.2, apply the upgrade immediately. Re-compile from source with the latest git master if a release tarball with the fix is not yet available.
   • Note: Because the patch is "CLAIMED" and not "CONFIRMED", verify the fix by testing the specific AVI trigger file against the patched build before rolling out to production.

3. Long-term Hardening:

   • Inventory: Maintain an inventory of all applications and systems using FFmpeg directly or via bundling (e.g., VLC, OpenCV). Ensure these are tracked for future security advisories.
   • Least Privilege: Ensure that FFmpeg processes run with the minimum necessary privileges to reduce the impact of code execution.
   • Monitor binary exploitation: Deploy runtime protections (e.g., ASLR, DEP/XN, Control Flow Guard) that are enabled by default on modern OSes.
   • Vulnerability scanning: Include FFmpeg in your vulnerability scanner templates to automatically identify embedded versions that may be out of date.
   • Incident Response Prep: Update your incident response playbooks to include a scenario for "media parser RCE," given the server-side risk of automatic processing.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-65703 — Official NVD description, CVSS score, CWE, and references for CVE-2026-65703.
2. FFmpeg Download & Changelog: https://ffmpeg.org/download.html — Official FFmpeg release and source code download page; used to verify the patched version.
3. CWE-787 Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html — Common Weakness Enumeration definition for the class of vulnerability.
4. CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document — Reference for the CVSS vector and scoring metrics used for this vulnerability.
5. FFmpeg Security Advisories: https://ffmpeg.org/security.html — FFmpeg's official security announcement page; the authoritative source for the patch reference (confirmed through NVD, but verify here).

Threat Actor Campaigns/Exploit-in-the-Wild Evidence: None reported. The vulnerability is NOT in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code or PoC is available. The EPSS score of 0.00207 (10.9th percentile) suggests that exploitation activity is currently negligible. However, the "CLAIMED" patch status (2/4) indicates that the fix may not be widely verified, and the broad affected version range makes this a high-priority candidate for monitoring in the coming weeks.