PT-2026-63435 · FFmpeg · Ffmpeg

CVE-2026-64831 · Publicado 2026-07-22 · Atualizado 2026-07-22

NVD

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps num hrd parameters value exceeding HEVC MAX SUB LAYERS in any supported container format to overflow stack-allocated arrays in the vk hevc end frame function, potentially achieving arbitrary code execution.

Correção

Stack Overflow

Enumeração de Fraquezas

CWE-121

Identificadores relacionados

CVE-2026-64831

Produtos afetados

Ffmpeg

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-64831 · Nota de Segurança
• https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed · Correção
• https://vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder · Nota
• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665 · Nota