A stack buffer overflow vulnerability (CWE-121) exists in FFmpeg versions 8.0 through 8.1.2 within the Vulkan HEVC hardware decoder. Remote attackers can exploit this by providing a specially crafted HEVC/H.265 bitstream containing a vps_num_hrd_parameters value that exceeds HEVC_MAX_SUB_LAYERS, causing overflow of stack-allocated arrays in the vk_hevc_end_frame function. This overflow can overwrite return addresses and adjacent stack frames, potentially enabling arbitrary code execution. The vulnerability affects all supported container formats that use this decoder. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation allows remote attackers to achieve arbitrary code execution on affected systems by exploiting a stack buffer overflow in the Vulkan HEVC hardware decoder of FFmpeg. This can compromise the confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable without privileges or user interaction beyond supplying a crafted media file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted HEVC/H.265 media streams using the Vulkan hardware decoder in FFmpeg versions 8.0 through 8.1.2.