{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/ffmpeg-8.0-through-8.1.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-64831"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FFmpeg (8.0 through 8.1.2)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","buffer-overflow","ffmpeg","media-processing","arbitrary-code-execution"],"_cs_type":"advisory","_cs_vendors":["FFmpeg"],"content_html":"\u003cp\u003eA significant stack buffer overflow vulnerability, identified as CVE-2026-64831, has been discovered in FFmpeg versions 8.0 through 8.1.2. This flaw resides specifically within the Vulkan HEVC (High Efficiency Video Coding) hardware decoder. Remote attackers can exploit this vulnerability by delivering a specially crafted HEVC/H.265 bitstream. The malicious bitstream contains an oversized \u003ccode\u003evps_num_hrd_parameters\u003c/code\u003e value that exceeds the \u003ccode\u003eHEVC_MAX_SUB_LAYERS\u003c/code\u003e limit, designed to overflow stack-allocated arrays. When processed by the vulnerable \u003ccode\u003evk_hevc_end_frame\u003c/code\u003e function, this overflow overwrites critical return addresses and adjacent stack frames, ultimately enabling attackers to achieve arbitrary code execution on affected systems. This vulnerability poses a severe risk to any application or system that uses vulnerable FFmpeg versions to process HEVC/H.265 video content.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eCraft Malicious Bitstream\u003c/strong\u003e: The attacker creates a specially crafted HEVC/H.265 bitstream, embedding a malicious \u003ccode\u003evps_num_hrd_parameters\u003c/code\u003e value that is larger than the \u003ccode\u003eHEVC_MAX_SUB_LAYERS\u003c/code\u003e threshold.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eEmbed Malicious Data\u003c/strong\u003e: The oversized \u003ccode\u003evps_num_hrd_parameters\u003c/code\u003e value is placed within the crafted HEVC/H.265 bitstream, ensuring it targets stack-allocated arrays.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDelivery\u003c/strong\u003e: The attacker delivers the malicious bitstream to a target system. This could occur through various means, such as embedding it in a video file, streaming content, or a media-sharing platform.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eProcessing by FFmpeg\u003c/strong\u003e: The target system, running a vulnerable version of FFmpeg (8.0 through 8.1.2), attempts to process the HEVC/H.265 bitstream using its Vulkan HEVC hardware decoder.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eFunction Execution\u003c/strong\u003e: The \u003ccode\u003evk_hevc_end_frame\u003c/code\u003e function within FFmpeg is invoked to handle the HEVC frame processing, including the malicious \u003ccode\u003evps_num_hrd_parameters\u003c/code\u003e value.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eStack Buffer Overflow\u003c/strong\u003e: Due to the oversized value, the \u003ccode\u003evk_hevc_end_frame\u003c/code\u003e function experiences a stack buffer overflow, causing critical data, including return addresses and adjacent stack frames, to be overwritten.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eArbitrary Code Execution\u003c/strong\u003e: The overwritten return address is manipulated to point to attacker-controlled code, leading to arbitrary code execution on the target system with the privileges of the FFmpeg process.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-64831 allows remote attackers to execute arbitrary code on systems utilizing vulnerable FFmpeg versions for HEVC/H.265 video processing. This can lead to full system compromise, data exfiltration, installation of malware, or disruption of services. The vulnerability's impact is broad, affecting any software or service that integrates FFmpeg as a core component for media handling, potentially impacting a wide range of applications from media players to video editing software and streaming platforms. There are no specific victim counts or targeted sectors mentioned, but any environment processing untrusted HEVC/H.265 video is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-64831 by updating all FFmpeg installations to a version beyond 8.1.2 immediately.\u003c/li\u003e\n\u003cli\u003eImplement strong input validation and sanitization for all incoming HEVC/H.265 bitstreams where possible, although this may not prevent exploitation for CVE-2026-64831 due to the nature of the vulnerability.\u003c/li\u003e\n\u003cli\u003eMonitor system logs for unexpected process crashes, abnormal memory usage, or unusual network connections originating from applications using FFmpeg, which could indicate attempted exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T17:18:40Z","date_published":"2026-07-22T17:18:40Z","id":"https://feed.craftedsignal.io/briefs/2026-07-ffmpeg-vulkan-hevc-overflow/","summary":"A stack buffer overflow vulnerability exists in the Vulkan HEVC hardware decoder within FFmpeg versions 8.0 through 8.1.2, allowing remote attackers to achieve arbitrary code execution by crafting a malicious HEVC/H.265 bitstream with an oversized vps_num_hrd_parameters value that overwrites return addresses and adjacent stack frames in the vk_hevc_end_frame function.","title":"FFmpeg Vulkan HEVC Stack Buffer Overflow (CVE-2026-64831)","url":"https://feed.craftedsignal.io/briefs/2026-07-ffmpeg-vulkan-hevc-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - FFmpeg (8.0 Through 8.1.2)","version":"https://jsonfeed.org/version/1.1"}