CVE-2026-18393: vLLM heap overflow

CISO Take

A heap buffer overflow in FFmpeg's tdsc_load_cursor() function lets a specially crafted video file corrupt memory beyond an allocated buffer, potentially crashing the process or, in a worst case, executing arbitrary code. The attack requires adjacent-network positioning, high attack complexity, and user interaction, and there is no EPSS score, no CISA KEV listing, no public exploit, and no scanner template, so real-world exploitation likelihood today is low. The concern for CISOs is blast radius: FFmpeg sits underneath 128 downstream dependents and is bundled into the rhoai/odh-vllm-gaudi-rhel9 image, meaning it can be reachable from multimodal AI pipelines that decode or transcode video uploads before feeding frames to a model. With 96 other known CVEs in FFmpeg and a package risk score of 61/100, this is one more entry in a chronically vulnerable dependency rather than an isolated incident. Patch to the fixed commit (242ff799c75f) in any FFmpeg build used by media-ingestion or vision-language model pipelines, and until patched, avoid processing untrusted or externally-sourced video in the same process space as production inference workloads.

Sources:NVDRed Hat Security Advisory

What is the risk?

Medium severity (CVSS 5.4) reflects a constrained exploitation path: adjacent-network access, high attack complexity, and required user interaction significantly limit remote drive-by exploitation compared to a typical internet-facing RCE. Confidentiality impact is none, integrity is low, but availability impact is high — the most probable outcome is a denial-of-service crash of the decoding process rather than reliable code execution. Risk rises specifically where FFmpeg runs inside automated, unattended pipelines (e.g., a vLLM Gaudi multimodal serving container that ingests video without a human validating each file), which effectively removes the 'user interaction' barrier CVSS assumes. No active exploitation, KEV listing, EPSS score, or public PoC exists, so urgency is driven by exposure (is FFmpeg reachable from untrusted video input in an AI service) rather than by known in-the-wild abuse.

How does the attack unfold?

Craft malicious video

Attacker builds a video file with a malformed TDSC cursor data structure designed to overflow a heap buffer when parsed.

Delivery to AI pipeline

The file is submitted from an adjacent network to a video-ingestion feature of an AI service (e.g., a multimodal vLLM Gaudi endpoint) or opened by a user, satisfying the required-interaction condition.

AML.T0049

Exploitation

FFmpeg's tdsc_load_cursor() writes past the bounds of the heap-allocated buffer while parsing the crafted cursor data, corrupting adjacent memory.

Impact

The decoding/inference worker crashes, denying service to the AI pipeline, or in a worst case the attacker achieves arbitrary code execution inside the serving container.

AML.T0029

Craft malicious video

Attacker builds a video file with a malformed TDSC cursor data structure designed to overflow a heap buffer when parsed.

Delivery to AI pipeline

The file is submitted from an adjacent network to a video-ingestion feature of an AI service (e.g., a multimodal vLLM Gaudi endpoint) or opened by a user, satisfying the required-interaction condition.

AML.T0049

Exploitation

FFmpeg's tdsc_load_cursor() writes past the bounds of the heap-allocated buffer while parsing the crafted cursor data, corrupting adjacent memory.

Impact

The decoding/inference worker crashes, denying service to the AI pipeline, or in a worst case the attacker achieves arbitrary code execution inside the serving container.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
96.0K94 dependentsPushed yesterday27% patched~37d to patchFull package profile →
ffmpeg	—	—	No patch

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What is the attack surface?

AVAdjacent

ACHigh

PRNone

UIRequired

SUnchanged

CNone

ILow

AHigh

What should I do?

1 step

Patch FFmpeg to the version containing the fix from commit 242ff799c75f20bade946314c8d741d0887ee11c (see patchwork.ffmpeg.org). For the rhoai/odh-vllm-gaudi-rhel9 image, pull and redeploy an updated container once Red Hat ships a rebuilt image referencing the patched FFmpeg (track bugzilla.redhat.com#2520309). Until patched, restrict video ingestion to trusted sources, run FFmpeg decoding in an isolated/sandboxed process (seccomp, gVisor, or a dedicated low-privilege container) separate from the model-serving process, and reject or pre-validate video files with unexpected TDSC cursor structures where feasible. Detection: monitor FFmpeg/decoding worker crash logs and unexpected process restarts in media-ingestion pipelines as a leading indicator of exploitation attempts.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionDoSInferenceAML.T0029- Denial of AI Service AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3-AI system technical documentation and security

NIST AI RMF

MANAGE 4.1-Post-deployment monitoring and risk mitigation for third-party components

OWASP LLM Top 10

LLM05:2025-Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-18393?

A heap buffer overflow in FFmpeg's tdsc_load_cursor() function lets a specially crafted video file corrupt memory beyond an allocated buffer, potentially crashing the process or, in a worst case, executing arbitrary code. The attack requires adjacent-network positioning, high attack complexity, and user interaction, and there is no EPSS score, no CISA KEV listing, no public exploit, and no scanner template, so real-world exploitation likelihood today is low. The concern for CISOs is blast radius: FFmpeg sits underneath 128 downstream dependents and is bundled into the rhoai/odh-vllm-gaudi-rhel9 image, meaning it can be reachable from multimodal AI pipelines that decode or transcode video uploads before feeding frames to a model. With 96 other known CVEs in FFmpeg and a package risk score of 61/100, this is one more entry in a chronically vulnerable dependency rather than an isolated incident. Patch to the fixed commit (242ff799c75f) in any FFmpeg build used by media-ingestion or vision-language model pipelines, and until patched, avoid processing untrusted or externally-sourced video in the same process space as production inference workloads.

Is CVE-2026-18393 actively exploited?

No confirmed active exploitation of CVE-2026-18393 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-18393?

Patch FFmpeg to the version containing the fix from commit 242ff799c75f20bade946314c8d741d0887ee11c (see patchwork.ffmpeg.org). For the rhoai/odh-vllm-gaudi-rhel9 image, pull and redeploy an updated container once Red Hat ships a rebuilt image referencing the patched FFmpeg (track bugzilla.redhat.com#2520309). Until patched, restrict video ingestion to trusted sources, run FFmpeg decoding in an isolated/sandboxed process (seccomp, gVisor, or a dedicated low-privilege container) separate from the model-serving process, and reject or pre-validate video files with unexpected TDSC cursor structures where feasible. Detection: monitor FFmpeg/decoding worker crash logs and unexpected process restarts in media-ingestion pipelines as a leading indicator of exploitation attempts.

What systems are affected by CVE-2026-18393?

This vulnerability affects the following AI/ML architecture patterns: model serving, multimodal inference pipelines, media preprocessing pipelines.

What is the CVSS score for CVE-2026-18393?

CVE-2026-18393 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

model servingmultimodal inference pipelinesmedia preprocessing pipelines

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM05:2025

What are the technical details?

Original Advisory

A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code execution.

Exploitation Scenario

An attacker positioned on the same network segment (or able to get a target/service to fetch a file from an adjacent host) crafts a video file containing a malformed TDSC cursor block designed to overflow a heap buffer in tdsc_load_cursor(). They submit or deliver this file to a video-ingestion feature of an AI service — for example, a multimodal model-serving endpoint built on the rhoai/odh-vllm-gaudi-rhel9 image that accepts video uploads for captioning or analysis, or a human user who opens the file locally, satisfying the CVSS 'user interaction required' condition. When FFmpeg parses the cursor data, the heap overflow corrupts adjacent memory, crashing the decoding worker (denial of service for the inference pipeline) or, if the attacker achieves reliable heap grooming, executing arbitrary code within the container running the AI workload.

Weaknesses (CWE)

CWE-787Out-of-bounds Write

CWE-787 — Out-of-bounds Write: The product writes data past the end, or before the beginning, of the intended buffer.

[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.

Source: MITRE CWE corpus.