EUVD-2026-80482
GHSA-w6ch-hfjf-3q38
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local V4L2 decoder access (AV:L/PR:L); crafting a valid underflowing HEVC RPS control on a niche driver is AC:H; OOB read yields bounded leak (C:L), no write (I:N), and likely fault (A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow
st_ref_pic_set_prediction() computes the reference RPS index as st_rps_idx - (delta_idx_minus1 + 1) per HEVC spec equation 7-59. Both operands are u8, so when delta_idx_minus1 + 1 exceeds the current index the subtraction wraps and the subsequent array access at calculated_rps_st_sets[ref_rps_idx] reads far out of bounds.
A userspace V4L2 client that can open the RKVDEC m2m decoder can submit an EXT_SPS_ST_RPS control with INTER_REF_PIC_SET_PRED set and delta_idx_minus1 crafted to trigger the underflow.
Reject the entry early when the reference index would underflow.
AnalysisAI
Out-of-bounds array reads in the Linux kernel's Rockchip rkvdec stateless HEVC decoder allow a local user who can open the V4L2 mem2m decoder device node to trigger an unsigned integer underflow in short-term reference picture set (RPS) prediction, causing the driver to index far outside the calculated_rps_st_sets array. The flaw is reached by submitting an EXT_SPS_ST_RPS control with the INTER_REF_PIC_SET_PRED flag set and a crafted delta_idx_minus1 value that exceeds the current RPS index; the CVSS vector requires local access with low privileges (PR:L), so no third-party user interaction is needed but the attacker must already hold permissions on the decoder device. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access to a system with the Rockchip RKVDEC stateless HEVC decoder driver enabled and a corresponding V4L2 m2m decoder device node the attacker can open (PR:L - a local user with decoder/video-group permissions). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix by updating to a Linux kernel release that contains the rkvdec HEVC RPS index guard; per the EUVD version data this means Linux 7.2.5 or 7.3-rc1 and later, or backporting upstream commit 74938f83a8abbee8f502dfb5d94213b2497d1edf (stable) / 052c5ed5a1d96a6b24fd50ccda16fc6841ee7ca3, which reject the RPS entry when the computed reference index would underflow. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all affected embedded Rockchip ARM systems running the Linux kernel with the rkvdec driver loaded (e.g., Rockchip RK3399, RK3288, and similar SoCs) and verify current kernel versions; obtain the vendor-released patch from your Linux distribution or Rockchip BSP provider (patch available per vendor advisory, exact version referenced therein), and prioritize applying it to systems where local user access to /dev/video* decoder nodes is broad. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today