EUVD-2026-47748
GHSA-mqq7-j9mq-9jwq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote crafted media processed with no auth (AV:N/PR:N) but a victim must decode it (UI:R); memory corruption threatens full C/I/A with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.
AnalysisAI
Stack buffer overflow in FFmpeg's Vulkan HEVC hardware decoder (versions 8.0 through 8.1.2) lets remote attackers overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream, potentially achieving arbitrary code execution. The flaw sits in the vk_hevc_end_frame function, where a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS overflows stack-allocated arrays. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that FFmpeg (8.0 through 8.1.2) be built with and actively using the Vulkan HEVC hardware decoder path - the vulnerable vk_hevc_end_frame function is only reached when hardware-accelerated Vulkan decoding of an HEVC/H.265 stream occurs, so deployments using the default software HEVC decoder or lacking Vulkan support are not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) scores 8.7, reflecting remote, low-complexity, unauthenticated triggering with high confidentiality/integrity/availability impact but requiring passive user interaction (UI:P) - a victim or pipeline must actually decode the malicious media. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts an HEVC/H.265 stream with a vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS, wraps it in any supported container (MP4, MKV, TS), and delivers it to a target that transcodes or previews uploaded media using FFmpeg 8.0-8.1.2 with Vulkan HEVC acceleration. When the victim service or user decodes the file, vk_hevc_end_frame overflows stack arrays, corrupting return addresses and potentially executing attacker-controlled code in the decoder's context. … |
| Remediation | Upstream fix available (PR/commit); a released patched version is not independently confirmed from the provided data - apply the upstream commit at https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed (associated PR https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23665) or upgrade to the first FFmpeg 8.1.x release that incorporates it and rebuild dependent libavcodec-based software. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running FFmpeg versions 8.0 through 8.1.2, including video transcoding servers, media ingest systems, and development environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restric
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protoco
The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors re
cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MA
Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt m
Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacker
Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacke
Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows atta
FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code
Same weakness CWE-121 – Stack-based Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today