FFmpeg CVE-2026-64832

Exploitation requires the target application to be built with NVIDIA NVDEC hardware-accelerated decoding and running on NVIDIA GPU hardware - software-only or non-NVIDIA deployments are not affected. The attacker must supply a crafted video file, and per CVSS UI:P a victim must decode that file (open/upload/transcode it), so this is not a fully autonomous remote attack. The specific trigger condition is decoder-surface exhaustion ("when no decoder surfaces remain"), which drives execution into the ff_nvdec_start_frame_sep_ref error path where nvdec_fdd_priv_free double-frees the frame description data. Limiting factors: required user interaction, dependence on a non-default NVDEC build/configuration, and NVIDIA-only platform requirement; no authentication is required (PR:N).

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, score 8.7) describes a network-delivered but user-interaction-dependent flaw with high confidentiality, integrity and availability impact and no scope change to subsequent systems - consistent with a client-side media-processing bug rather than a server-side pre-auth RCE. The UI:P (passive interaction) metric is the key limiter: a victim must actually decode the malicious file through an NVDEC-enabled build, which narrows the real-world attack surface to environments that use NVIDIA GPU hardware decoding. No EPSS score, KEV listing, or SSVC decision data was provided, so probabilistic exploitation signals are unavailable; combined with no public POC, this reads as a real but not urgently-mass-exploited issue. Note a caveat: double-free bugs frequently yield reliable crashes/DoS but achieving VI:H/VC:H (code execution) depends on heap layout and mitigations, so the vendor's high integrity/confidentiality ratings represent worst-case potential rather than a demonstrated exploit - verify exploitability against the specific build before treating VI:H as confirmed.

An attacker crafts a video file whose stream forces NVDEC to exhaust its decoder surfaces, then delivers it via a website, media upload, or messaging so a victim's NVDEC-enabled player or server-side transcoder decodes it. Processing triggers the error path in ff_nvdec_start_frame_sep_ref, double-freeing the frame description data and corrupting the heap, which at minimum crashes the process and may enable code execution in the decoding context. No public exploit is currently identified, so this remains a plausible rather than demonstrated attack.