EUVD-2026-47756
GHSA-jc8j-9799-c943
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Crafted file is delivered remotely (AV:N) but a victim must decode it (UI:R), no auth needed (PR:N); double-free memory corruption yields potential code execution, so C/I/A:H worst-case.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.
AnalysisAI
Memory corruption in FFmpeg 4.4 through 8.1.2 lets an attacker trigger a double-free in the NVIDIA NVDEC hardware decoder (libavcodec/nvdec.c) by getting a victim to process a crafted video file, potentially leading to code execution or crash in any NVDEC-accelerated pipeline. The flaw sits in the ff_nvdec_start_frame_sep_ref error path, which frees frame description data via nvdec_fdd_priv_free while the calling layer later frees the same object. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target application to be built with NVIDIA NVDEC hardware-accelerated decoding and running on NVIDIA GPU hardware - software-only or non-NVIDIA deployments are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, score 8.7) describes a network-delivered but user-interaction-dependent flaw with high confidentiality, integrity and availability impact and no scope change to subsequent systems - consistent with a client-side media-processing bug rather than a server-side pre-auth RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a video file whose stream forces NVDEC to exhaust its decoder surfaces, then delivers it via a website, media upload, or messaging so a victim's NVDEC-enabled player or server-side transcoder decodes it. Processing triggers the error path in ff_nvdec_start_frame_sep_ref, double-freeing the frame description data and corrupting the heap, which at minimum crashes the process and may enable code execution in the decoding context. … |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - apply the upstream FFmpeg fix commit 4c6217477fc64305055b37d9d1d0d76d30e37f97 (https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97) or update to a vendor release incorporating it once tagged, and rebuild dependent applications that statically or dynamically link libavcodec. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running FFmpeg 4.4 through 8.1.2 with NVIDIA NVDEC support enabled and assess whether they process untrusted video input. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restric
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protoco
The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors re
cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MA
Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt m
Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacker
Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacke
Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows atta
FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code
Same weakness CWE-415 – Double Free
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today