FFmpeg EUVD-2026-47748

Exploitation requires that FFmpeg (8.0 through 8.1.2) be built with and actively using the Vulkan HEVC hardware decoder path - the vulnerable vk_hevc_end_frame function is only reached when hardware-accelerated Vulkan decoding of an HEVC/H.265 stream occurs, so deployments using the default software HEVC decoder or lacking Vulkan support are not exposed. The trigger is a crafted HEVC bitstream carrying a vps_num_hrd_parameters value greater than HEVC_MAX_SUB_LAYERS, embeddable in any supported container format. Limiting factors: the CVSS UI:P metric confirms passive user interaction is required - the malicious media must actually be opened/decoded by a victim or automated pipeline; no authentication is needed (PR:N); and reliable code execution must overcome stack canaries, ASLR, and DEP, which is not guaranteed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) scores 8.7, reflecting remote, low-complexity, unauthenticated triggering with high confidentiality/integrity/availability impact but requiring passive user interaction (UI:P) - a victim or pipeline must actually decode the malicious media. No EPSS score was provided, and the CVE is not in CISA KEV, so there is no evidence of active exploitation; the intelligence status is 'no public exploit identified at time of analysis.' Two signals temper the raw score: exploitation requires the Vulkan HEVC hardware decode path to be in use (not FFmpeg's default software decoder), and reliable RCE from a stack overflow must defeat modern mitigations (stack canaries, ASLR, DEP), so 'potentially achieving arbitrary code execution' is a plausible but unproven upper bound rather than a confirmed outcome. This is a credible priority for environments running FFmpeg 8.0-8.1.2 with Vulkan HEVC acceleration on attacker-supplied media, but likely lower urgency for the majority of deployments using software decoding.

An attacker crafts an HEVC/H.265 stream with a vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS, wraps it in any supported container (MP4, MKV, TS), and delivers it to a target that transcodes or previews uploaded media using FFmpeg 8.0-8.1.2 with Vulkan HEVC acceleration. When the victim service or user decodes the file, vk_hevc_end_frame overflows stack arrays, corrupting return addresses and potentially executing attacker-controlled code in the decoder's context. No public exploit is identified at time of analysis, and success depends on defeating stack protections, so this reflects the intended attack path rather than a demonstrated working exploit.