PT-2026-63435 · FFmpeg · Ffmpeg

CVE-2026-64831 · Published 2026-07-22 · Updated 2026-07-22

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps num hrd parameters value exceeding HEVC MAX SUB LAYERS in any supported container format to overflow stack-allocated arrays in the vk hevc end frame function, potentially achieving arbitrary code execution.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-64831

Affected Products

Ffmpeg

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-64831 · Security Note
• https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed · Patch
• https://vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-vulkan-hevc-decoder · Note
• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665 · Note