CVE-2026-64832

High

Description

FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.

SeverityHigh

CVSS8.8

Exploit probability—

ProductFfmpeg

PublishedJul 22, 2026

First seenJul 22, 2026

Weakness typeCWE-415CWE-415

How to fix

Patches

code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97

Affected products

Product	Affected versions	Fixed in
ffmpeg ffmpeg	4.4 ≤ v ≤ 8.1.2	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.