FFmpeg 8.1.2

FFmpeg versions 4.4 through 8.1.2 are vulnerable to a double-free condition within the NVIDIA NVDEC hardware decoder component (libavcodec/nvdec.c), allowing attackers to trigger memory corruption by providing a specially crafted video file, which occurs when an error path frees memory via `nvdec_fdd_priv_free` due to no decoder surfaces remaining, and a subsequent layer attempts to free the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware acceleration.

FFmpeg versions 2.1 through 8.1.2 contain a heap buffer overflow vulnerability (CVE-2026-64830) in the VobSub subtitle demuxer, allowing attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file, potentially leading to arbitrary code execution in applications using FFmpeg's VobSub demuxer.