CVE-2026-64832 in FFmpeg
Summary
by MITRE • 07/22/2026
FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability represents a critical memory corruption issue affecting FFmpeg versions 4.4 through 8.1.2 that stems from improper memory management within the NVIDIA NVDEC hardware decoder implementation. The flaw exists in the libavcodec/nvdec.c file where the ff_nvdec_start_frame_sep_ref error path executes nvdec_fdd_priv_free to release memory resources, but subsequent code execution in the calling layer performs a second free operation on the same frame description data structure. This double-free condition creates a scenario where the underlying decoder context memory is freed twice, leading to undefined behavior and potential remote code execution opportunities within any application that leverages FFmpeg's hardware-accelerated decoding capabilities through NVDEC.
The technical nature of this vulnerability aligns with CWE-415, which specifically addresses double free conditions in software implementations. This memory corruption flaw occurs during the processing of video files when FFmpeg attempts to handle video streams using NVIDIA's hardware decoding acceleration. The vulnerability is particularly dangerous because it can be triggered through crafted video files that cause the decoder to enter an error path where memory cleanup operations are duplicated. When no decoder surfaces remain available, the error handling mechanism in the NVDEC implementation inadvertently causes the same memory block to be deallocated twice, creating opportunities for attackers to manipulate heap memory layout and potentially execute arbitrary code.
The operational impact of this vulnerability extends across numerous applications that depend on FFmpeg for video processing, including media players, streaming services, content management systems, and security surveillance platforms. Any application utilizing FFmpeg's NVDEC hardware acceleration for video decoding becomes a potential target for exploitation, as the double-free condition can be triggered through maliciously crafted video files without requiring any special privileges or user interaction. The vulnerability affects not just end-user applications but also server-side processing systems that handle multimedia content, creating widespread exposure across different deployment environments and use cases.
Mitigation strategies should focus on immediate version updates to FFmpeg 8.2 or later where this double-free issue has been resolved through proper memory management implementation in the NVDEC decoder. Organizations should also implement input validation measures for video files to prevent processing of potentially malicious content, particularly when dealing with untrusted sources. Additionally, system administrators should consider disabling NVDEC hardware acceleration temporarily while applying patches, and implementing network-based intrusion detection systems that can identify attempts to exploit this vulnerability through crafted media files. The fix implemented in newer FFmpeg versions properly handles the memory cleanup sequence to prevent duplicate free operations while maintaining the functionality of the NVIDIA hardware decoder acceleration.