CVE-2026-64831
Fixed in a distro release EPSS <1%CVSS 8.8
FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.
Products: FFMPEG
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | eco-python-ffmpeg-8-minimal | 8.1.3-r0 |
| Chainguard | eco-python-ffmpeg-8-minimal-dev | 8.1.3-r0 |
| Chainguard | eco-python-ffmpeg-8-minimal-static | 8.1.3-r0 |
| Chainguard | ffmpeg-8.0 | 0 |
| Chainguard | ffmpeg-8.1 | 0 |
| Chainguard | ffmpeg-fips-8.0 | no fix |
| Chainguard | ffmpeg-fips-8.0-dev | no fix |
| Chainguard | ffmpeg-fips-8.0-libavcodec62 | no fix |
| Chainguard | ffmpeg-fips-8.0-libavdevice62 | no fix |
| Chainguard | ffmpeg-fips-8.0-libavfilter11 | no fix |
| Chainguard | ffmpeg-fips-8.0-libavformat62 | no fix |
| Chainguard | ffmpeg-fips-8.0-libavutil60 | no fix |
| Chainguard | ffmpeg-fips-8.0-libavutil60 | 0 |
| Chainguard | ffmpeg-fips-8.0-libswresample6 | no fix |
| Chainguard | ffmpeg-fips-8.0-libswscale9 | no fix |
| Chainguard | ffmpeg-fips-8.0-static | no fix |
| Chainguard | ffmpeg-fips-8.0-static | 0 |
| Debian 14 | ffmpeg | 7:9.0.2-1 |
| Ubuntu 26.10 | ffmpeg | no fix |
| Ubuntu Pro 14.04 LTS | libav | no fix |
| Ubuntu Pro 26.04 LTS | ffmpeg | 7:8.0.1-3ubuntu2+esm4 |
| Wolfi | ffmpeg-8.0 | 0 |
| Wolfi | ffmpeg-8.1 | 0 |