CVE-2026-64831 Overview
CVE-2026-64831 is a stack buffer overflow vulnerability [CWE-121] in FFmpeg versions 8.0 through 8.1.2. The flaw exists in the Vulkan HEVC hardware decoder, specifically within the vk_hevc_end_frame function. Attackers can craft a malicious HEVC/H.265 bitstream containing a vps_num_hrd_parameters value that exceeds the HEVC_MAX_SUB_LAYERS bound. Processing this bitstream overflows stack-allocated arrays, overwriting return addresses and adjacent stack frames. Successful exploitation can lead to arbitrary code execution in the context of the process decoding the media file.
Critical Impact
Remote attackers can trigger arbitrary code execution by delivering a crafted HEVC bitstream through any supported container format, when the target user opens or streams the file with Vulkan HEVC hardware decoding enabled.
Affected Products
- FFmpeg 8.0
- FFmpeg 8.1 through 8.1.2
- Applications and services embedding the affected FFmpeg Vulkan HEVC decoder
Discovery Timeline
- 2026-07-22 - CVE-2026-64831 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-64831
Vulnerability Analysis
The defect resides in FFmpeg's Vulkan-based HEVC hardware decoder. The vk_hevc_end_frame function copies Hypothetical Reference Decoder (HRD) parameter entries into fixed-size stack arrays sized by HEVC_MAX_SUB_LAYERS. The decoder does not validate the vps_num_hrd_parameters field parsed from the Video Parameter Set (VPS) against this bound before iterating. When the attacker-controlled count exceeds the array capacity, subsequent writes corrupt adjacent stack memory, including saved return addresses.
Because HEVC streams can be embedded in any supported container (MP4, MKV, TS, HLS segments), the malicious payload can be delivered through video files, streaming URLs, or web-based media players that use FFmpeg as a backend. User interaction is required — typically opening or previewing the crafted media.
Root Cause
The root cause is missing input validation on a length field parsed from untrusted media data. The Vulkan HEVC decoder trusts vps_num_hrd_parameters from the bitstream and uses it as a loop bound when populating fixed-size stack buffers, violating the invariant enforced by HEVC_MAX_SUB_LAYERS.
Attack Vector
Exploitation requires an attacker to deliver a crafted HEVC/H.265 stream that a victim decodes with an FFmpeg build using the Vulkan HEVC hardware decoder. Delivery mechanisms include downloaded video files, malicious streaming links, adversary-controlled web pages that auto-play video, and pipeline services that transcode user-supplied media.
No authentication is required. The victim must process the media, satisfying the user interaction requirement. Stack corruption may be leveraged for control-flow hijack, though modern stack protections (stack canaries, ASLR, DEP) can complicate reliable code execution depending on the build configuration.
No public proof-of-concept exploit is currently documented. See the VulnCheck Advisory: FFmpeg Overflow for additional technical detail.
Detection Methods for CVE-2026-64831
Indicators of Compromise
- HEVC or H.265 media files containing a vps_num_hrd_parameters value greater than HEVC_MAX_SUB_LAYERS (7) parsed from the VPS NAL unit.
- Crashes, segmentation faults, or stack canary violations in processes linking libavcodec with Vulkan HEVC decoding enabled.
- Unexpected child processes or outbound network connections initiated by media players, transcoders, or thumbnail generators after processing untrusted video.
Detection Strategies
- Inspect HEVC VPS NAL units at ingress (mail gateways, web proxies, upload pipelines) and reject streams with out-of-bound HRD parameter counts.
- Monitor endpoints and media transcoding servers for FFmpeg process crashes correlated with recently opened media files.
- Alert on anomalous process lineage where ffmpeg, ffprobe, or applications embedding libavcodec spawn shells, script interpreters, or network utilities.
Monitoring Recommendations
- Enable core dump collection on media processing hosts to capture stack corruption evidence for triage.
- Log FFmpeg version strings and enabled hardware decoders across the fleet to identify vulnerable Vulkan HEVC builds.
- Track file-write and network telemetry from user-facing media applications to detect post-exploitation behavior.
How to Mitigate CVE-2026-64831
Immediate Actions Required
- Inventory all systems and applications shipping FFmpeg 8.0 through 8.1.2, including bundled copies inside third-party software.
- Upgrade to a patched FFmpeg build that incorporates the fix from FFmpeg commit 92737390dc.
- Restrict decoding of untrusted HEVC content in server-side transcoding pipelines until patches are deployed.
Patch Information
The upstream fix is tracked in FFmpeg Pull Request 23665 and applied in commit 92737390dc133daadce47dd7d2ec8ef3d9ebcbed. The patch validates vps_num_hrd_parameters against HEVC_MAX_SUB_LAYERS before populating stack arrays in vk_hevc_end_frame. Rebuild dependent applications against the patched libavcodec and redeploy.
Workarounds
- Disable the Vulkan HEVC hardware decoder and fall back to software HEVC decoding until the patched version is deployed.
- Configure media services to reject or transcode HEVC content through a sandboxed, patched decoder before downstream processing.
- Restrict user permissions on hosts running FFmpeg so that potential code execution is contained within a low-privilege account.
# Force software HEVC decoding and avoid the Vulkan hardware path
ffmpeg -hwaccel none -c:v hevc -i input.mp4 -f null -
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
