FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows… (CVE-2026-64832)
FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder component. This flaw occurs in the error handling path when no decoder surfaces remain, leading to memory corruption by freeing the same memory twice. The vulnerability affects any FFmpeg-based application using NVDEC hardware-accelerated decoding and can be triggered by a crafted video file.
AI Analysis
Technical Summary
A double-free vulnerability exists in FFmpeg versions 4.4 through 8.1.2 within the NVIDIA NVDEC hardware decoder implementation in libavcodec/nvdec.c. Specifically, when the ff_nvdec_start_frame_sep_ref error path is triggered due to no remaining decoder surfaces, it frees memory via nvdec_fdd_priv_free. Subsequently, the calling layer also frees the same frame description data, causing a double-free of the decoder context. This can lead to memory corruption in applications using NVDEC hardware acceleration for video decoding.
Potential Impact
Successful exploitation of this vulnerability allows an attacker to cause memory corruption in FFmpeg-based applications that utilize NVIDIA NVDEC hardware decoding by supplying a crafted video file. This may lead to application crashes or potentially enable further exploitation depending on the application's context and memory management.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted video files with affected FFmpeg versions using NVDEC hardware acceleration.
FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows… (CVE-2026-64832)
Description
FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder component. This flaw occurs in the error handling path when no decoder surfaces remain, leading to memory corruption by freeing the same memory twice. The vulnerability affects any FFmpeg-based application using NVDEC hardware-accelerated decoding and can be triggered by a crafted video file.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A double-free vulnerability exists in FFmpeg versions 4.4 through 8.1.2 within the NVIDIA NVDEC hardware decoder implementation in libavcodec/nvdec.c. Specifically, when the ff_nvdec_start_frame_sep_ref error path is triggered due to no remaining decoder surfaces, it frees memory via nvdec_fdd_priv_free. Subsequently, the calling layer also frees the same frame description data, causing a double-free of the decoder context. This can lead to memory corruption in applications using NVDEC hardware acceleration for video decoding.
Potential Impact
Successful exploitation of this vulnerability allows an attacker to cause memory corruption in FFmpeg-based applications that utilize NVIDIA NVDEC hardware decoding by supplying a crafted video file. This may lead to application crashes or potentially enable further exploitation depending on the application's context and memory management.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted video files with affected FFmpeg versions using NVDEC hardware acceleration.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jc8j-9799-c943
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64832"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a6151239c2644c7f8da624c
Added to database: 07/22/2026, 23:24:19 UTC
Last enriched: 07/23/2026, 01:07:11 UTC
Last updated: 07/23/2026, 02:57:14 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.