CVE-2026-64832

Executive Summary

Business Impact: This vulnerability poses a significant risk to any organization utilizing FFmpeg for video processing, transcoding, or streaming, particularly in media and entertainment, broadcasting, video surveillance, and content delivery networks (CDNs). The likely attacker is a remote, unauthenticated threat actor who can deliver a crafted video file to a target application. The attack vector is local execution triggered by user interaction (e.g., opening a malicious video file), but the impact is severe due to the potential for arbitrary code execution within the context of the FFmpeg process.

Vulnerability Class and Attack Vector: This is a Double-Free vulnerability (CWE-415) residing in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c. The attack vector is Local (AV:L) as it requires the attacker to supply a crafted video file to an FFmpeg-based application. The attack complexity is Low (AC:L), requiring no special privileges (PR:N), but does require User Interaction (UI:R) to open or process the malicious file.

Urgency Assessment: Despite a High CVSS score of 8.8, the EPSS (Exploit Prediction Scoring System) probability is 0.0% as of the publication date. This indicates that while the vulnerability is severe, there are currently no known active exploits in the wild. However, the lack of a patch and the availability of the technical details in the NVD description mean that weaponization is a matter of time. The urgency is High for proactive patching and monitoring, but Low for immediate incident response.

Key Facts:

• Vendor: FFmpeg
• Affected Versions: 4.4 through 8.1.2
• Patch Status: UNPATCHED as of 2026-07-22
• CISA KEV: Not listed.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector (AV): Local (L) — The attacker must supply a crafted video file to the target system. The vulnerability is not exploitable over a network protocol directly; it requires the file to be processed locally.
• Attack Complexity (AC): Low (L) — No special conditions or race conditions are required. The double-free occurs deterministically when a specific error path is triggered.
• Privileges Required (PR): None (N) — The attacker does not need any prior authentication or privileges on the target system.
• User Interaction (UI): Required (R) — A user must open or process the crafted video file using an FFmpeg-based application.
• Scope (S): Unchanged (U) — The vulnerability affects only the vulnerable component (FFmpeg process). It does not impact other resources or security boundaries.
• Confidentiality (C): High (H) — Successful exploitation can lead to arbitrary code execution, allowing the attacker to read sensitive data from the process memory.
• Integrity (I): High (H) — Arbitrary code execution allows the attacker to modify data or inject malicious code.
• Availability (A): High (H) — The double-free can cause a crash (denial of service) or be leveraged for code execution, impacting availability.

Qualitative Severity Label: High

EPSS Interpretation: An EPSS score of 0.0% means that the model predicts a near-zero probability of exploitation in the wild within the next 30 days. This is typical for a newly published CVE with no known PoC or active exploitation. This score will likely increase as technical details are analyzed and weaponized.

Historical Comparison: This vulnerability is similar in class to CVE-2023-51794 (a double-free in FFmpeg's libavformat), CVE-2021-38291 (a use-after-free in FFmpeg's libavcodec), and CVE-2020-22015 (a heap-buffer-overflow in FFmpeg). All are memory corruption vulnerabilities in media parsing libraries that require user interaction and can lead to code execution.

Temporal & Environmental Scores: The temporal score is currently elevated due to the lack of a patch and no official fix. The environmental score can be adjusted based on the deployment context. For systems where FFmpeg processes untrusted user-uploaded video files (e.g., social media platforms, video sharing sites), the risk is Critical. For systems where FFmpeg only processes trusted, internally-generated content, the risk is Medium.

Technical Deep Dive & Attack Mechanics

Step-by-Step Technical Explanation:

1. Initialization: When FFmpeg processes a video file using the NVIDIA NVDEC hardware decoder, it allocates a set of decoder surfaces (frames) in the nvdec_fdd_priv_free context. This context holds metadata about the decoded frames, including the AVFrame data.
2. Error Path Trigger: The vulnerability is in the ff_nvdec_start_frame_sep_ref function within libavcodec/nvdec.c. This function is called to start decoding a new frame. If no decoder surfaces are available (e.g., due to a resource exhaustion or a crafted video that exhausts the surface pool), the function enters an error path.
3. First Free: In this error path, the code calls nvdec_fdd_priv_free to release the frame description data (fdd_priv). This function frees the memory associated with the decoder context.
4. Second Free: After the error path returns, the calling layer (likely in decode_simple_internal or a similar function) also attempts to free the same frame description data, unaware that it has already been freed. This results in a double-free of the underlying decoder context.
5. Memory Corruption: The double-free corrupts the heap metadata. An attacker can potentially control the freed memory chunk's size and content, leading to a write-what-where condition or a use-after-free, which can be leveraged for arbitrary code execution.

Root Cause Analysis: The developer error is a failure to properly set a pointer to NULL after freeing it, or a failure to check if the resource was already freed before attempting to free it again. The error path in ff_nvdec_start_frame_sep_ref does not communicate back to the caller that the frame description data has already been released, leading to a double-free.

Attack Surface:

• Interface: Any application that uses FFmpeg's libavcodec with the NVDEC hardware decoder enabled.
• Protocols: The vulnerability is triggered by processing a crafted video file. The file can be delivered via HTTP, FTP, SMB, email attachment, or any other file transfer mechanism.
• Ports: No specific network ports are directly exploitable. The attack is file-based.

Pre-conditions for Exploitation:

• The target system must have an NVIDIA GPU with NVDEC support.
• FFmpeg must be compiled with --enable-cuda-nvdec or similar flag.
• The user must process a crafted video file (e.g., .mp4, .mkv, .avi) using an FFmpeg-based application (e.g., ffmpeg, ffplay, VLC, GStreamer).

Attack Variants:

• Denial of Service (DoS): The simplest exploitation is to cause a crash by triggering the double-free.
• Arbitrary Code Execution (ACE): A skilled attacker can manipulate the heap state to overwrite function pointers or other critical data, leading to code execution.

Why Standard Defenses May Fail:

• ASLR/DEP: While these mitigations make exploitation harder, they do not prevent the double-free itself. A determined attacker can bypass them using information leaks or heap spraying.
• Sandboxing: If the FFmpeg process is sandboxed, the impact of code execution is limited. However, many applications do not sandbox their media processing libraries.
• Input Validation: Standard file validation (e.g., magic bytes, file size) will not detect this vulnerability as it is a logic error in the decoder, not a malformed file structure.

Vulnerable vs. Patched Code Analysis

Vulnerable Code (Pseudocode):

// libavcodec/nvdec.c
static int ff_nvdec_start_frame_sep_ref(AVCodecContext *avctx, AVFrame *frame) {
    NVDECContext *ctx = avctx->priv_data;
    // ... allocation logic ...
    if (no_surfaces_available) {
        // Error path: free the frame description data
        nvdec_fdd_priv_free(&ctx->fdd_priv);  // First free
        return AVERROR(ENOMEM);
    }
    // ... normal path ...
    return 0;
}

// Calling layer (e.g., decode_simple_internal)
int decode_simple_internal(AVCodecContext *avctx, AVFrame *frame) {
    int ret = ff_nvdec_start_frame_sep_ref(avctx, frame);
    if (ret < 0) {
        // Error handling: free the frame description data again
        nvdec_fdd_priv_free(&ctx->fdd_priv);  // Second free (double-free)
        return ret;
    }
    // ...
}

Patched Code (Hypothetical):

// libavcodec/nvdec.c
static int ff_nvdec_start_frame_sep_ref(AVCodecContext *avctx, AVFrame *frame) {
    NVDECContext *ctx = avctx->priv_data;
    // ... allocation logic ...
    if (no_surfaces_available) {
        // Error path: free the frame description data and set pointer to NULL
        nvdec_fdd_priv_free(&ctx->fdd_priv);
        ctx->fdd_priv = NULL;  // Fix: prevent double-free
        return AVERROR(ENOMEM);
    }
    // ... normal path ...
    return 0;
}

// Calling layer
int decode_simple_internal(AVCodecContext *avctx, AVFrame *frame) {
    int ret = ff_nvdec_start_frame_sep_ref(avctx, frame);
    if (ret < 0) {
        // Check if already freed
        if (ctx->fdd_priv) {
            nvdec_fdd_priv_free(&ctx->fdd_priv);
        }
        return ret;
    }
    // ...
}

What the Patch Changes: The fix sets ctx->fdd_priv to NULL after the first free, or adds a check in the calling layer to verify the pointer is not NULL before freeing. This prevents the second free from occurring.

Regression Considerations: The patch is minimal and should not introduce regressions. However, teams should test their specific FFmpeg workflows, especially those involving NVDEC hardware decoding, to ensure no other error paths are affected.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-22T18:17:05.483
• Estimated Discovery Timeline: Unknown. The vulnerability was likely discovered through internal code auditing or fuzzing.
• Disclosure Process: The CVE was published by the CNA (likely MITRE or the FFmpeg project). No vendor coordination details are available.
• Known Exploitation in the Wild: No known active exploitation as of 2026-07-22.
• CISA KEV Addition Date: Not applicable.

Threat Intelligence Context

• Threat Actor Profile: This vulnerability is attractive to a wide range of threat actors:
  • APT Groups: Nation-state actors may use this for targeted attacks against media organizations, broadcasters, or surveillance systems.
  • Ransomware Operators: Could use this to gain initial access or escalate privileges on media servers.
  • Script Kiddies: Once a PoC is released, it will be used for DoS attacks against video processing services.
• Attack Campaign Context: No specific campaigns are associated with this CVE at this time.
• Geographic Targeting Patterns: Unknown.
• Industry Verticals Most at Risk:
  • Media & Entertainment (video editing, streaming)
  • Broadcasting (live TV, transcoding)
  • Video Surveillance (NVRs, DVRs)
  • Content Delivery Networks (CDNs)
  • Social Media Platforms (user-uploaded video processing)
• Connection to Similar Vulnerability Classes: Double-free vulnerabilities in media libraries (e.g., libpng, libjpeg, libavcodec) have been historically exploited for code execution. This is a recurring class of bug in complex C/C++ codebases.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Environment: Ubuntu 22.04 LTS with an NVIDIA GPU (e.g., GTX 1080) and NVIDIA drivers (version 535 or later).
2. Dependencies:

   sudo apt update
   sudo apt install build-essential pkg-config libx264-dev libx265-dev libvpx-dev libfdk-aac-dev libmp3lame-dev libopus-dev
   

3. Vulnerable FFmpeg Installation:

   git clone https://git.ffmpeg.org/ffmpeg.git ffmpeg
   cd ffmpeg
   git checkout n8.1.2  # Vulnerable version
   ./configure --enable-cuda-nvdec --enable-cuvid --enable-nonfree --enable-libnpp --extra-cflags=-I/usr/local/cuda/include --extra-ldflags=-L/usr/local/cuda/lib64
   make -j$(nproc)
   sudo make install
   

4. Crafted Video File: Create a video file that exhausts the NVDEC surface pool. This can be done by crafting a video with an extremely high number of reference frames or a specific GOP structure that triggers the error path. (Note: This is a non-trivial task and requires deep knowledge of the NVDEC API and FFmpeg internals.)

Exploitation Walkthrough:

1. Deliver the Crafted File: The attacker delivers the crafted video file to the target (e.g., via email, web upload, or network share).
2. Trigger the Vulnerability: The user processes the file with an FFmpeg-based application:

   ffmpeg -hwaccel cuda -hwaccel_output_format cuda -i crafted_video.mp4 -f null -
   

3. Expected Output: The FFmpeg process will crash with a double-free error, or if the heap is manipulated, it may execute arbitrary code.
4. Post-Exploitation: After gaining code execution, the attacker can:
   • Execute a reverse shell.
   • Dump process memory (e.g., decrypted video streams, API keys).
   • Pivot to other systems on the network.

Blue Team Section

Detection:

• Log Entries: FFmpeg may log errors like double free or corruption (!prev) or Segmentation fault in system logs (/var/log/syslog, journalctl).
• Network Traffic: No specific network signatures. The attack is file-based.
• Endpoint Behavioral Indicators:
  • High CPU/GPU usage during video processing.
  • FFmpeg process crashes.
  • Unexpected child processes spawned by FFmpeg (if code execution is achieved).

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Detection Engineering

YARA Rule

rule CVE_2026_64832_FFmpeg_NVDEC_DoubleFree {
    meta:
        description = "Detects crafted video files targeting CVE-2026-64832 in FFmpeg NVDEC decoder"
        author = "Valters IT Hub"
        date = "2026-07-22"
        reference = "https://www.valtersit.com/cve/cve-2026-64832"
        hash = "[EXAMPLE — not a real IOC]"
    strings:
        $nvenc_header = { 4E 56 45 4E 43 00 00 00 01 }  // NVENC header in video stream
        $nvenc_surface_exhaust = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }  // Pattern indicating exhausted surface pool (example)
        $double_free_pattern = { 64 6F 75 62 6C 65 20 66 72 65 65 }  // "double free" string in memory
    condition:
        uint32(0) == 0x66747970  // "ftyp" box (MP4 file) and
        ($nvenc_header at 0x100 or $nvenc_surface_exhaust) and
        $double_free_pattern
}

Sigma Rule (SIEM)

title: CVE-2026-64832 FFmpeg NVDEC Double-Free Exploitation
id: 32d74715-43d4-4b6c-819e-50fc8ade3f72
status: experimental
description: Detects exploitation attempts targeting CVE-2026-64832 in FFmpeg via process crash logs.
author: Valters IT Hub
date: 2026-07-22
references:
    - https://www.valtersit.com/cve/cve-2026-64832
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/ffmpeg'
        CommandLine|contains: '-hwaccel cuda'
    condition: selection
falsepositives:
    - Legitimate use of FFmpeg with NVDEC hardware acceleration for normal video processing.
level: high

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-64832 FFmpeg NVDEC Double-Free Exploitation - Crafted Video File Transfer"; flow:to_server; content:"|66 74 79 70|"; depth:4; content:"|6D 70 34 32|"; distance:0; within:4; classtype:attempted-user; sid:1000001; rev:1;)

Note: This rule detects the transfer of an MP4 file, which is a common container for the crafted video. It is a broad detection and will generate false positives.

Elastic (EQL) Query

process where event.type == "start" and process.name == "ffmpeg" and process.command_line : "* -hwaccel cuda*" and process.exit_code == -6

Note: Exit code -6 (SIGABRT) is common for double-free crashes.

Splunk SPL Query

index=linux_secure sourcetype=syslog "double free" OR "Segmentation fault" AND "ffmpeg"
| stats count by host, process

Wazuh Rule

<rule id="100001" level="12">
    <if_sid>530</if_sid>
    <match>double free or corruption</match>
    <description>CVE-2026-64832: Possible FFmpeg NVDEC double-free exploitation</description>
    <group>pci_dss_11.4,gdpr_art_33,</group>
</rule>

Remediation & Mitigation

Immediate Actions (0-24 hours)

• Patch: No official patch is available. Monitor the FFmpeg security page for updates.
• Compensating Controls:
  • Disable NVDEC Hardware Acceleration: If possible, disable NVDEC in FFmpeg by not using the -hwaccel cuda flag. Use software decoding instead (-hwaccel none).
  • Sandboxing: Run FFmpeg in a sandboxed environment (e.g., Docker container with limited capabilities, seccomp, AppArmor).
  • Input Validation: Implement strict file validation before processing. Reject video files with unusual parameters (e.g., extremely high number of reference frames).
• Network-Level Mitigation: Block uploads of video files to untrusted sources if possible.
• Authentication/Access Control: Ensure that only trusted users can upload video files for processing.

Short-term (1-7 days)

• Configuration Hardening: Review FFmpeg configuration and disable unnecessary codecs and decoders.
• Monitoring Implementation: Deploy the detection rules provided above to monitor for exploitation attempts.
• Vulnerability Scanning: Use a script to check the FFmpeg version:

  ffmpeg -version | grep "ffmpeg version"
  

  If the version is between 4.4 and 8.1.2, it is vulnerable.

Long-term

• Architecture Changes: Migrate to a different video processing library (e.g., GStreamer with software decoding) if NVDEC is not critical.
• Security Control Improvements: Implement a robust file sanitization pipeline that uses multiple decoders to validate video files.
• Developer Training: Educate developers on the dangers of double-free vulnerabilities and proper memory management in C/C++.

Validation

• Patch Confirmation: Once a patch is released, upgrade FFmpeg and verify the version:

  ffmpeg -version | grep "ffmpeg version"
  

• Functional Test: Run a test with a crafted video file (if available) to ensure the crash no longer occurs.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-64832
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-64832
• Vendor advisory: See vendor security page (https://ffmpeg.org/security.html)
• OSV: https://osv.dev/vulnerability/CVE-2026-64832
• Related CWE: https://cwe.mitre.org/data/definitions/415.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1203/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-22 | https://www.valtersit.com/cve/cve-2026-64832