CVE-2026-64832

Name of the Vulnerable Software and Affected Versions FFmpeg versions 4.4 through 8.1.2

Description A double-free issue exists in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c. An attacker can trigger memory corruption by providing a specially crafted video file. This occurs when no decoder surfaces remain; the ff nvdec start frame sep ref() error path releases memory through nvdec fdd priv free(), and the calling layer subsequently releases the same frame description data. This results in a double-free of the underlying decoder context in applications utilizing NVDEC hardware-accelerated decoding.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.