CVE-2026-64831 in FFmpeg
Summary
by MITRE • 07/22/2026
FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability represents a critical stack buffer overflow in FFmpeg's Vulkan hardware acceleration implementation for HEVC decoding, affecting versions 8.0 through 8.1.2. The flaw exists within the vk_hevc_end_frame function where stack-allocated arrays are improperly validated against the maximum allowed sub-layers parameter. Attackers can exploit this by crafting malicious HEVC/H.265 bitstreams containing a vps_num_hrd_parameters value that exceeds the defined HEVC_MAX_SUB_LAYERS constant, which serves as a fundamental boundary check for hardware decoder operations. The vulnerability manifests when FFmpeg processes video content through Vulkan hardware acceleration, specifically targeting the HEVC decoder implementation that leverages GPU compute capabilities for video decoding tasks.
The technical exploitation occurs through improper input validation where the software fails to enforce bounds checking on the vps_num_hrd_parameters field within the video parameter set structure. This field determines the number of HRD (Hypothetical Reference Decoder) parameters in the HEVC bitstream, and when this value exceeds the expected maximum sub-layers limit, it triggers a stack-based buffer overflow condition. The vulnerability stems from CWE-121 Stack-based Buffer Overflow, where insufficient validation allows an attacker to write beyond allocated memory boundaries. The heap allocation occurs within the Vulkan hardware decoding context where memory layout is predetermined, making return addresses and adjacent stack frames susceptible to modification during exploitation attempts.
Operationally, this vulnerability creates a significant risk for users processing multimedia content through FFmpeg's hardware-accelerated decoding paths, particularly those utilizing Vulkan-based systems for video transcoding or playback. Remote attackers can achieve arbitrary code execution by crafting malicious video files that trigger the overflow condition, potentially leading to complete system compromise when FFmpeg is used in server environments or applications handling untrusted media input. The attack surface extends across all container formats supported by FFmpeg since the vulnerability is rooted in the underlying HEVC decoding logic rather than specific file format parsing. This makes the exploit particularly dangerous in scenarios involving automated video processing pipelines, content delivery networks, or web applications that utilize FFmpeg for media handling.
Mitigation strategies should prioritize immediate version updates to FFmpeg 8.2 or later where the buffer overflow has been addressed through proper bounds checking of the vps_num_hrd_parameters field. Organizations should implement input validation measures that sanitize HEVC bitstream parameters before processing, particularly when handling untrusted content through automated workflows. The fix typically involves adding explicit range checks to ensure vps_num_hrd_parameters values remain within acceptable limits relative to HEVC_MAX_SUB_LAYERS and other related constants. Additionally, system administrators should consider disabling hardware acceleration for HEVC decoding where possible until the vulnerability is fully patched, particularly in environments processing untrusted media content. Security monitoring should be enhanced to detect unusual patterns in video processing operations that might indicate exploitation attempts.
This vulnerability aligns with ATT&CK technique T1059.007 Command and Scripting Interpreter: JavaScript, as it enables attackers to execute arbitrary code through manipulated media files, though the actual exploitation pathway is more specifically related to software exploitation techniques involving buffer overflows. The broader implications extend to supply chain security where vulnerable FFmpeg installations in various applications and operating systems could be compromised, potentially affecting end-user devices through malicious media content delivery. The vulnerability demonstrates how hardware acceleration features can introduce new attack vectors when not properly validated against standard security boundaries, highlighting the importance of comprehensive input sanitization even within optimized code paths that leverage specialized hardware capabilities for performance gains.