There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated
    buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a
    specially crafted video file, potentially leading to a denial of service or arbitrary code execution.
    (CVE-2026-18393)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 FFmpeg 中发现一个缺陷。tdsc_load_cursor（） 函数在处理构建的 TDSC 游标数据时，写入超出堆分配的缓冲区边界。远程攻击者可通过提供特制的视频文件利用此漏洞，可能导致拒绝服务或任意代码执行。
    (CVE-2026-18393)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 在 FFmpeg 中發現缺陷。當處理特製的 TDSC 游標資料時，tdsc_load_cursor（） 函式會寫入超出堆積配置緩衝區的界限。遠端攻擊者可以透過提供特製的視訊檔案來利用這一點，從而可能導致拒絕服務或任意程式碼執行。
    (CVE-2026-18393)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - FFmpeg に欠陥が見つかりました。細工された TDSC カーソルデータを処理する際に、tdsc_load_cursor() 関数がヒープ割り当てバッファの領域外に書き込みを行います。リモートの攻撃者がこれを悪用して、特別に細工されたビデオファイルを提供することで、サービス拒否または任意のコードの実行を引き起こす可能性があります。
    (CVE-2026-18393)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated     buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a     specially crafted video file, potentially leading to a denial of service or arbitrary code execution.
    (CVE-2026-18393)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5220-1 advisory.

    - CVE-2023-6602: HLS Force TTY Demuxer (bsc#1220546).
    - CVE-2023-6604: HLS XBIN Demuxer DoS Amplification (bsc#1220549).
    - CVE-2024-35367: FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static     const vec_s8       h_subpel_filters_outer (bsc#1234029).
    - CVE-2026-18393: Heap buffer overflow in tdsc_load_cursor() via CUR_FMT_MONO cursor (bsc#1277377).
    - CVE-2026-38344: A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of     FFmpeg       N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video     file       (bsc#1277309).
    - CVE-2026-38345: FFmpeg: Denial of Service via division-by-zero vulnerability in     `ff_sws_init_single_context` function       (bsc#1277376).
    - CVE-2026-38346: FFmpeg: Denial of Service via crafted video file due to integer overflow (bsc#1277375).
    - CVE-2026-38347: FFmpeg: Heap overflow vulnerability leads to Denial of Service (bsc#1277373).
    - CVE-2026-38348: FFmpeg: Denial of Service via crafted image file due to integer overflow (bsc#1277368).
    - CVE-2026-38349: FFmpeg: Denial of Service via crafted image file due to integer overflow (bsc#1277369).
    - CVE-2026-38350: FFmpeg: Integer overflow leads to Denial of Service (bsc#1277370).
    - CVE-2026-52296: out-of-bounds read due to missing required padding in WMA extradata allocation paths     (bsc#1280752).
    - CVE-2026-65705: vf_floodfill Out-of-Bounds Write via filter_frame() (bsc#1272761).
    - CVE-2026-66036: Heap Out-of-Bounds Write in vf_hqdn3d Filter (bsc#1272763).
    - CVE-2026-70628: signed integer underflows during subtitle buffer checks can cause heap buffer overflows     (bsc#1274268).
    - CVE-2026-70629: unvalidated decompressed frame sizes in video decoders can cause uninitialized heap     memory reads       (bsc#1274270).
    - CVE-2026-70630: unvalidated decompression sizes in Screenpresso frame decoding can cause uninitialized     heap memory       reads (bsc#1274282).
    - CVE-2026-70631: unvalidated decompression sizes in TIFF strip decoding can cause uninitialized heap     memory reads       (bsc#1274287).
    - CVE-2026-70632: unenforced frame dimensions in CineForm HD decoding can cause heap-based out-of-bounds     writes       (bsc#1274289).
    - CVE-2026-75141: heap buffer overflow in the hvcC box writer (bsc#1276407).
    - CVE-2026-75142: stack buffer overflow in the MPEG-PS muxer (bsc#1276408).
    - CVE-2026-75144: heap buffer overflow in the VC-2/Dirac RTP packetizer (bsc#1276410).
    - CVE-2026-75146: out-of-bounds read in the DASH demuxer (bsc#1276412).
    - CVE-2026-90815: out-of-bounds read in the convolution video filter when processing videos with     dimensions smaller than       the convolution kernel size (bsc#1280754).
    - CVE-2026-90816: CPU exhaustion due to missing validations in the `parse_playlist()` function when     processing a crafted       HLS playlist (bsc#1280755).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
459408	Echo: ffmpeg: security update to 7:7.1.5-0+deb13u1	Tenable Cloud Security	Echo Local Security Checks	2026/10/2	2026/10/2	medium
459408	Echo: ffmpeg: security update to 7:7.1.5-0+deb13u1	Tenable Self-Hosted Container Security	Echo Local Security Checks	2026/10/2	2026/10/2	medium
341682	Linux Distros 未修补的漏洞：CVE-2026-18393	Nessus	Misc.	2026/8/31	2026/11/11	medium
341682	Linux Distros 未修補弱點：CVE-2026-18393	Nessus	Misc.	2026/8/31	2026/11/11	medium
341682	Linux Distros のパッチ未適用の脆弱性: CVE-2026-18393	Nessus	Misc.	2026/8/31	2026/11/11	medium
341682	Linux Distros Unpatched Vulnerability : CVE-2026-18393	Nessus	Misc.	2026/8/31	2026/11/11	medium
380997	SUSE SLED15: ffmpeg / libavcodec-devel / libavcodec57 / libavdevice57 / etc (SUSE-SU-2026:5220-1)	Nessus	SuSE Local Security Checks	2026/11/14	2026/11/14	high

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

high