CVE-2026-64832: FFmpeg Use-After-Free Vulnerability

CVE-2026-64832 Overview

CVE-2026-64832 is a double-free vulnerability [CWE-415] affecting FFmpeg versions 4.4 through 8.1.2. The flaw resides in the NVIDIA NVDEC hardware decoder implementation within libavcodec/nvdec.c. Attackers can trigger memory corruption by supplying a crafted video file to any FFmpeg-based application using NVDEC hardware-accelerated decoding. The vulnerability manifests when no decoder surfaces remain and the ff_nvdec_start_frame_sep_ref error path frees memory that the calling layer subsequently frees again.

Critical Impact
Successful exploitation results in memory corruption of the underlying decoder context, potentially enabling arbitrary code execution or denial of service in any application relying on FFmpeg NVDEC decoding.

Affected Products

FFmpeg version 4.4 through 8.1.2
Applications using FFmpeg libavcodec with NVIDIA NVDEC hardware-accelerated decoding
Media processing pipelines and transcoders built on affected FFmpeg releases

Discovery Timeline

2026-07-22 - CVE-2026-64832 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-64832

Vulnerability Analysis

The vulnerability exists in FFmpeg's integration with NVIDIA's NVDEC hardware decoder. When decoding a frame, ff_nvdec_start_frame_sep_ref allocates and associates frame description data with the decoder context. If the function reaches an error path because no decoder surfaces remain available, it invokes nvdec_fdd_priv_free to release the associated memory. The calling layer, unaware that cleanup has already occurred, later frees the same frame description data. The result is a double-free of the underlying decoder context.

Attackers exploit this condition by crafting a video file that exhausts decoder surfaces during processing. Once the double-free triggers, adjacent heap metadata can be corrupted. Depending on allocator behavior and process state, this corruption can lead to controlled memory writes and arbitrary code execution within the FFmpeg process.

Root Cause

The root cause is inconsistent ownership semantics between ff_nvdec_start_frame_sep_ref and its callers. The error path releases resources it should not own when unwinding, while the caller assumes cleanup responsibility remains its own. This dual-free path violates the single-owner rule required to prevent [CWE-415] Double Free conditions.

Attack Vector

Exploitation requires the target application to decode attacker-controlled video content using NVDEC. This is common in web services accepting user-uploaded media, streaming platforms, video conferencing applications, and desktop media players. User interaction such as opening or previewing a malicious file is typically required. See the VulnCheck Advisory: FFmpeg Double Free for additional context and the FFmpeg Commit Update for the patch details.

Detection Methods for CVE-2026-64832

Indicators of Compromise

Unexpected crashes or segmentation faults in FFmpeg processes handling NVDEC decoding
Heap corruption diagnostics or glibc double free or corruption messages in application logs
Anomalous media files that consistently exhaust NVDEC decoder surfaces during processing

Detection Strategies

Inventory installed FFmpeg binaries and shared libraries (libavcodec.so) and confirm version strings fall within 4.4 through 8.1.2
Enable AddressSanitizer or heap protection instrumentation in test environments to surface the double-free during fuzzing of media pipelines
Monitor for repeated process restarts or crash loops in transcoding, streaming, or conferencing services that rely on GPU-accelerated decoding

Monitoring Recommendations

Log and alert on abnormal termination of processes linked against vulnerable libavcodec builds
Track ingestion of media files that reference unusual codec parameters or trigger NVDEC surface exhaustion
Correlate GPU driver error events with parent process crashes to identify potential exploitation attempts

How to Mitigate CVE-2026-64832

Immediate Actions Required

Update FFmpeg to a fixed release beyond 8.1.2 that incorporates the upstream patch
Rebuild and redeploy any applications statically linked against vulnerable FFmpeg versions
Restrict decoding of untrusted media on systems where patched FFmpeg is not yet available

Patch Information

The fix is available through the upstream FFmpeg Commit Update and tracked in FFmpeg Pull Request 23664. The patch corrects the ownership semantics in ff_nvdec_start_frame_sep_ref so that the error path no longer frees frame description data that the caller will release. Downstream distributions should ship updated packages containing this commit.

Workarounds

Disable NVDEC hardware-accelerated decoding and fall back to software decoders until the patch is applied
Validate and sandbox media inputs, rejecting files from untrusted sources or processing them in isolated containers
Constrain FFmpeg processes with seccomp, AppArmor, or SELinux profiles to limit the impact of memory corruption

bash

# Configuration example: disable NVDEC and force software decoding
ffmpeg -hwaccel none -i input.mp4 -c:v libx264 output.mp4