CVE-2026-64831: FFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC Decoder
FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vpsnumhrdparameters value exceeding HEVCMAXSUBLAYERS in any supported container format to overflow stack-allocated arrays in the vkhevcendframe function, potentially achieving arbitrary code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpeg (Vulkan HEVC hardware decoder)to a version that resolves this vulnerability.Fixed in 8.1.2 - Compensating control
If you cannot upgrade immediately, mitigate by disabling use of the Vulkan HEVC hardware decoder / Vulkan HEVC decoding path so crafted HEVC/H.265 bitstreams cannot reach vk_hevc_end_frame.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64831?
The severity of CVE-2026-64831 is rated high with a CVSS score of 8.8.
How do I fix CVE-2026-64831?
To fix CVE-2026-64831, update FFmpeg to version 8.1.3 or later which addresses this vulnerability.
What type of vulnerability is CVE-2026-64831?
CVE-2026-64831 is a stack buffer overflow vulnerability in the Vulkan HEVC decoder.
What can attackers achieve with CVE-2026-64831?
Attackers exploiting CVE-2026-64831 can overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream.
Which versions of FFmpeg are affected by CVE-2026-64831?
FFmpeg versions 8.0 through 8.1.2 are affected by CVE-2026-64831.