CVE-2026-64832
Received Received - Intake

Double-Free in FFmpeg NVDEC Hardware Decoder

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: VulnCheck

Description
FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-64832
EUVD
EUVD-2026-47756

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ffmpeg ffmpeg From 4.4 (inc) to 8.1.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a double-free vulnerability in FFmpeg versions 4.4 through 8.1.2 affecting the NVIDIA NVDEC hardware decoder. When a crafted video file is processed, the error path ff_nvdec_start_frame_sep_ref frees memory via nvdec_fdd_priv_free, but the calling layer also frees the same frame description data. This causes a double-free of the decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.

Detection Guidance

Detecting this vulnerability requires checking the FFmpeg version and analyzing video processing applications for NVDEC usage. Inspect FFmpeg installations with 'ffmpeg -version' and look for versions between 4.4 and 8.1.2. Monitor logs for crashes or memory corruption errors during video decoding. Use static analysis tools to scan libavcodec/nvdec.c for vulnerable code paths.

Impact Analysis

An attacker could exploit this to trigger memory corruption, potentially leading to crashes, arbitrary code execution, or denial-of-service conditions in applications using FFmpeg with NVIDIA NVDEC hardware decoding.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling memory corruption attacks that may lead to unauthorized data access or processing. A double-free flaw in FFmpeg's NVIDIA NVDEC decoder could allow attackers to execute arbitrary code or crash applications, which may result in data breaches or violations of data integrity requirements under these regulations.

Mitigation Strategies

Immediately update FFmpeg to version 8.1.3 or later to patch the double-free vulnerability. Disable NVDEC hardware acceleration in FFmpeg-based applications by setting 'hwaccel=none' in configuration files or command-line arguments. Temporarily block untrusted video files until updates are applied. Monitor vendor advisories for additional mitigation guidance.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64832. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart