CVE-2026-64831

EUVD-2026-47748

22.07.2026, 17:16

FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.8 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 57.38%

Affected Products (NVD)

Vendor	Product	Version
ffmpeg	ffmpeg	8.0 ≤ 𝑥 ≤ 8.1.2

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ffmpeg

bookworm	7:5.1.9-0+deb12u1 fixed
bookworm (security)	7:5.1.9-0+deb12u1 fixed
forky	7:9.0.2-1 fixed
sid	7:9.0.2-2 fixed
trixie	7:7.1.5-0+deb13u1 fixed
trixie (security)	7:7.1.5-0+deb13u1 fixed

Ubuntu Releases

Ubuntu Product

Codename

ffmpeg

bionic	not-affected
focal	not-affected
jammy	not-affected
noble	not-affected
resolute	Fixed 7:8.0.1-3ubuntu2+esm4 released
xenial	not-affected

libav

jammy	dne
noble	dne
resolute	dne
trusty	needs-triage

Common Weakness Enumeration

CWE-121 - Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665

https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder