{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/ffmpeg-8.1.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-64832"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FFmpeg 4.4","FFmpeg 5.x","FFmpeg 6.x","FFmpeg 7.x","FFmpeg 8.0","FFmpeg 8.1.0","FFmpeg 8.1.1","FFmpeg 8.1.2"],"_cs_severities":["high"],"_cs_tags":["vulnerability","memory-corruption","ffmpeg","nvdec","cve"],"_cs_type":"advisory","_cs_vendors":["FFmpeg","NVIDIA"],"content_html":"\u003cp\u003eA significant double-free vulnerability, tracked as CVE-2026-64832, exists in FFmpeg versions 4.4 through 8.1.2, specifically within the NVIDIA NVDEC hardware decoder component (libavcodec/nvdec.c). This flaw allows an attacker to induce memory corruption by providing a specially crafted video file to an FFmpeg-based application that utilizes NVDEC hardware-accelerated decoding. The vulnerability arises when the \u003ccode\u003eff_nvdec_start_frame_sep_ref\u003c/code\u003e error path is triggered due to a lack of available decoder surfaces. In this scenario, \u003ccode\u003envdec_fdd_priv_free\u003c/code\u003e prematurely releases memory associated with the frame description data. Subsequently, the calling layer attempts to free the same memory, leading to a double-free condition of the underlying decoder context. This issue impacts any application integrating affected FFmpeg versions and leveraging NVIDIA NVDEC for video decoding, posing a risk of application crashes, denial of service, or potentially arbitrary code execution depending on memory layout and exploitation techniques.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious video file designed to trigger specific error conditions within FFmpeg's NVDEC decoding process.\u003c/li\u003e\n\u003cli\u003eThe victim opens or processes the malicious video file using an FFmpeg-based application configured for NVIDIA NVDEC hardware acceleration.\u003c/li\u003e\n\u003cli\u003eDuring the decoding process, the FFmpeg application reaches a state where no decoder surfaces are available, triggering an error path.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eff_nvdec_start_frame_sep_ref\u003c/code\u003e error handling routine is invoked within \u003ccode\u003elibavcodec/nvdec.c\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eWithin this error path, the \u003ccode\u003envdec_fdd_priv_free\u003c/code\u003e function is called, releasing the memory allocated for the frame description data.\u003c/li\u003e\n\u003cli\u003eSubsequently, the higher-level FFmpeg calling layer attempts to free the \u003cem\u003esame\u003c/em\u003e memory region for the frame description data, leading to a double-free vulnerability.\u003c/li\u003e\n\u003cli\u003eThe double-free corrupts memory, potentially causing a crash of the FFmpeg-based application, leading to a denial of service.\u003c/li\u003e\n\u003cli\u003eDepending on the memory corruption primitive and system architecture, this could be escalated to arbitrary code execution, allowing the attacker to run malicious code on the victim's system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-64832 can lead to severe consequences for users of affected FFmpeg applications. The primary impact is memory corruption, which typically results in application crashes and denial of service. This could disrupt critical video processing workflows or render affected media playback applications unusable. In more sophisticated exploitation scenarios, memory corruption vulnerabilities like double-frees can be chained with other techniques to achieve arbitrary code execution, allowing attackers to compromise the underlying system. This poses a risk to any system processing untrusted video content using vulnerable FFmpeg versions with NVDEC acceleration, potentially leading to data theft, system control, or further network intrusion.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate FFmpeg to a version beyond 8.1.2 immediately to remediate CVE-2026-64832.\u003c/li\u003e\n\u003cli\u003eIdentify all applications in your environment that utilize FFmpeg for video processing, especially those configured for NVIDIA NVDEC hardware acceleration.\u003c/li\u003e\n\u003cli\u003eConsult the changelogs or security advisories for applications dependent on FFmpeg to ensure they have integrated the patched FFmpeg versions to address CVE-2026-64832.\u003c/li\u003e\n\u003cli\u003eAs a temporary mitigation if immediate patching is not possible, consider disabling NVIDIA NVDEC hardware acceleration in FFmpeg-based applications or restricting the processing of untrusted video files.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T18:17:58Z","date_published":"2026-07-22T18:17:58Z","id":"https://feed.craftedsignal.io/briefs/2026-07-ffmpeg-nvdec-double-free/","summary":"FFmpeg versions 4.4 through 8.1.2 are vulnerable to a double-free condition within the NVIDIA NVDEC hardware decoder component (libavcodec/nvdec.c), allowing attackers to trigger memory corruption by providing a specially crafted video file, which occurs when an error path frees memory via `nvdec_fdd_priv_free` due to no decoder surfaces remaining, and a subsequent layer attempts to free the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware acceleration.","title":"FFmpeg NVIDIA NVDEC Double-Free Vulnerability (CVE-2026-64832)","url":"https://feed.craftedsignal.io/briefs/2026-07-ffmpeg-nvdec-double-free/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-64830"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FFmpeg 2.1","FFmpeg 8.1.2"],"_cs_severities":["high"],"_cs_tags":["vulnerability","heap-overflow","ffmpeg","arbitrary-code-execution","media"],"_cs_type":"advisory","_cs_vendors":["FFmpeg"],"content_html":"\u003cp\u003eA significant heap buffer overflow vulnerability, identified as CVE-2026-64830, has been discovered in FFmpeg versions ranging from 2.1 through 8.1.2. This flaw resides within the VobSub subtitle demuxer component. The vulnerability can be exploited by an attacker who crafts a specially designed \u003ccode\u003e.sub\u003c/code\u003e or \u003ccode\u003e.idx\u003c/code\u003e subtitle file. This malicious file is configured to declare a number of distinct stream IDs that exceeds the fixed-size array boundaries within \u003ccode\u003elibavformat/mpeg.c\u003c/code\u003e. When an application utilizing FFmpeg's VobSub demuxer attempts to process such a file, the \u003ccode\u003eff_subtitles_queue_insert()\u003c/code\u003e function triggers an unbounded write beyond the \u003ccode\u003evobsub-\u0026gt;q[]\u003c/code\u003e array, leading to heap memory corruption. Successful exploitation could result in arbitrary code execution within the context of the vulnerable application, posing a severe risk to systems processing untrusted media content.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker creates a malicious VobSub subtitle file (either \u003ccode\u003e.sub\u003c/code\u003e or \u003ccode\u003e.idx\u003c/code\u003e extension).\u003c/li\u003e\n\u003cli\u003eThe crafted subtitle file is specifically designed to declare an excessive number of distinct stream IDs beyond expected limits.\u003c/li\u003e\n\u003cli\u003eThe attacker delivers the malicious subtitle file to a victim, typically alongside a video file, enticing them to play the media.\u003c/li\u003e\n\u003cli\u003eA media player or application that uses FFmpeg's VobSub demuxer attempts to parse the malicious subtitle file.\u003c/li\u003e\n\u003cli\u003eDuring the demuxing process, the \u003ccode\u003eff_subtitles_queue_insert()\u003c/code\u003e function within FFmpeg is invoked to handle the stream IDs.\u003c/li\u003e\n\u003cli\u003eDue to the overly large number of stream IDs in the malicious file, the function attempts to write data beyond the allocated boundary of the \u003ccode\u003evobsub-\u0026gt;q[]\u003c/code\u003e array.\u003c/li\u003e\n\u003cli\u003eThis action results in a heap buffer overflow, corrupting adjacent heap memory within the application's process.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages this memory corruption to achieve arbitrary code execution, gaining control over the compromised application and potentially the underlying system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-64830 leads directly to arbitrary code execution within any application that processes malicious VobSub subtitle files using vulnerable FFmpeg versions. The primary impact is the complete compromise of the affected application, allowing an attacker to execute commands, install malware, or exfiltrate sensitive data in the context of the user running the application. While the number of observed victims or specific sectors targeted is not detailed, this vulnerability broadly affects any system where FFmpeg is used to handle untrusted subtitle files, such as media servers, video editing software, or streaming platforms, making any user of such systems a potential target.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePrioritize patching FFmpeg to a version above 8.1.2 or applying relevant security updates to mitigate CVE-2026-64830.\u003c/li\u003e\n\u003cli\u003eEducate users to exercise caution when opening or importing subtitle files (\u003ccode\u003e.sub\u003c/code\u003e, \u003ccode\u003e.idx\u003c/code\u003e) from untrusted or unknown sources.\u003c/li\u003e\n\u003cli\u003eImplement application whitelisting to restrict the execution of unauthorized code that might be dropped or executed as a result of exploitation.\u003c/li\u003e\n\u003cli\u003eMonitor process creation events for media player applications (log source: process_creation) for unusual child processes, especially those related to shell execution or unexpected network connections.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T17:17:56Z","date_published":"2026-07-22T17:17:56Z","id":"https://feed.craftedsignal.io/briefs/2026-07-ffmpeg-vobsub-heap-overflow/","summary":"FFmpeg versions 2.1 through 8.1.2 contain a heap buffer overflow vulnerability (CVE-2026-64830) in the VobSub subtitle demuxer, allowing attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file, potentially leading to arbitrary code execution in applications using FFmpeg's VobSub demuxer.","title":"FFmpeg VobSub Heap Buffer Overflow Vulnerability (CVE-2026-64830)","url":"https://feed.craftedsignal.io/briefs/2026-07-ffmpeg-vobsub-heap-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - FFmpeg 8.1.2","version":"https://jsonfeed.org/version/1.1"}