A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code execution.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5220-1 advisory.

    - CVE-2023-6602: HLS Force TTY Demuxer (bsc#1220546).
    - CVE-2023-6604: HLS XBIN Demuxer DoS Amplification (bsc#1220549).
    - CVE-2024-35367: FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static     const vec_s8       h_subpel_filters_outer (bsc#1234029).
    - CVE-2026-18393: Heap buffer overflow in tdsc_load_cursor() via CUR_FMT_MONO cursor (bsc#1277377).
    - CVE-2026-38344: A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of     FFmpeg       N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video     file       (bsc#1277309).
    - CVE-2026-38345: FFmpeg: Denial of Service via division-by-zero vulnerability in     `ff_sws_init_single_context` function       (bsc#1277376).
    - CVE-2026-38346: FFmpeg: Denial of Service via crafted video file due to integer overflow (bsc#1277375).
    - CVE-2026-38347: FFmpeg: Heap overflow vulnerability leads to Denial of Service (bsc#1277373).
    - CVE-2026-38348: FFmpeg: Denial of Service via crafted image file due to integer overflow (bsc#1277368).
    - CVE-2026-38349: FFmpeg: Denial of Service via crafted image file due to integer overflow (bsc#1277369).
    - CVE-2026-38350: FFmpeg: Integer overflow leads to Denial of Service (bsc#1277370).
    - CVE-2026-52296: out-of-bounds read due to missing required padding in WMA extradata allocation paths     (bsc#1280752).
    - CVE-2026-65705: vf_floodfill Out-of-Bounds Write via filter_frame() (bsc#1272761).
    - CVE-2026-66036: Heap Out-of-Bounds Write in vf_hqdn3d Filter (bsc#1272763).
    - CVE-2026-70628: signed integer underflows during subtitle buffer checks can cause heap buffer overflows     (bsc#1274268).
    - CVE-2026-70629: unvalidated decompressed frame sizes in video decoders can cause uninitialized heap     memory reads       (bsc#1274270).
    - CVE-2026-70630: unvalidated decompression sizes in Screenpresso frame decoding can cause uninitialized     heap memory       reads (bsc#1274282).
    - CVE-2026-70631: unvalidated decompression sizes in TIFF strip decoding can cause uninitialized heap     memory reads       (bsc#1274287).
    - CVE-2026-70632: unenforced frame dimensions in CineForm HD decoding can cause heap-based out-of-bounds     writes       (bsc#1274289).
    - CVE-2026-75141: heap buffer overflow in the hvcC box writer (bsc#1276407).
    - CVE-2026-75142: stack buffer overflow in the MPEG-PS muxer (bsc#1276408).
    - CVE-2026-75144: heap buffer overflow in the VC-2/Dirac RTP packetizer (bsc#1276410).
    - CVE-2026-75146: out-of-bounds read in the DASH demuxer (bsc#1276412).
    - CVE-2026-90815: out-of-bounds read in the convolution video filter when processing videos with     dimensions smaller than       the convolution kernel size (bsc#1280754).
    - CVE-2026-90816: CPU exhaustion due to missing validations in the `parse_playlist()` function when     processing a crafted       HLS playlist (bsc#1280755).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated
    buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a
    specially crafted video file, potentially leading to a denial of service or arbitrary code execution.
    (CVE-2026-18393)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated     buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a     specially crafted video file, potentially leading to a denial of service or arbitrary code execution.
    (CVE-2026-18393)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
380997	SUSE SLED15: ffmpeg / libavcodec-devel / libavcodec57 / libavdevice57 / etc (SUSE-SU-2026:5220-1)	Nessus	SuSE Local Security Checks	Local	high
459408	Echo: ffmpeg: security update to 7:7.1.5-0+deb13u1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459408	Echo: ffmpeg: security update to 7:7.1.5-0+deb13u1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
341682	Linux Distros Unpatched Vulnerability : CVE-2026-18393	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-18393

medium

Tenable Plugins

high

medium

medium

medium