Stack Buffer Overflow in FFmpeg 8.0-8.1.2 Vulkan HEVC Decoder
CVE-2026-64831 Published on July 22, 2026

FFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC Decoder
FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.

NVD

Vulnerability Analysis

CVE-2026-64831 can be exploited with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
PASSIVE

Weakness Type

What is a Stack Overflow Vulnerability?

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

CVE-2026-64831 has been classified to as a Stack Overflow vulnerability or weakness.


Products Associated with CVE-2026-64831

Want to know whenever a new CVE is published for FFmpeg? stack.watch will email you.

FFmpeg
 

Affected Versions

FFmpeg: