CVE-2026-64831

Name of the Vulnerable Software and Affected Versions FFmpeg versions 8.0 through 8.1.2

Description A stack buffer overflow exists in the Vulkan HEVC hardware decoder. A remote attacker can overwrite return addresses and adjacent stack frames by providing a specially crafted HEVC/H.265 bitstream. By embedding a malicious vps num hrd parameters value that exceeds HEVC MAX SUB LAYERS within any supported container format, the attacker can overflow stack-allocated arrays in the vk hevc end frame() function, which may lead to arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.