PT-2026-63441 · FFmpeg · Ffmpeg

CVE-2026-64832 · Published 2026-07-22 · Updated 2026-07-22

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff nvdec start frame sep ref error path frees memory via nvdec fdd priv free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2026-64832

Affected Products

Ffmpeg

References · 4

• https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-64832 · Security Note
• https://vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c · Note
• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664 · Note