CVE-2026-64832: FFmpeg 4.4 - 8.1.2 Double-Free in NVDEC Hardware Decoder via nvdec.c
FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ffnvdecstartframesepref error path frees memory via nvdecfddprivfree while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpeg libavcodec/nvdec.c (NVDEC hardware decoder)to a version that resolves this vulnerability.Fixed in 8.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64832?
CVE-2026-64832 has a high severity score of 8.8.
How do I fix CVE-2026-64832?
To fix CVE-2026-64832, update FFmpeg to version 8.1.3 or later that addresses the double-free vulnerability.
What systems are affected by CVE-2026-64832?
FFmpeg versions 4.4 through 8.1.2 are affected by CVE-2026-64832.
What type of vulnerability is CVE-2026-64832?
CVE-2026-64832 is a double-free vulnerability that can lead to memory corruption.
How can attackers exploit CVE-2026-64832?
Attackers can exploit CVE-2026-64832 by supplying a crafted video file to trigger the vulnerability during video decoding.