Is CVE-2026-18393 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-18393?

CVE-2026-18393 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-18393

Description

A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code execution.