CVE-2026-64832: FFmpeg double-free — HIGH

CISO Take

FFmpeg's NVIDIA NVDEC hardware decoder has a double-free flaw (CWE-415) in libavcodec/nvdec.c: when the GPU runs out of decoder surfaces, the ff_nvdec_start_frame_sep_ref error path frees the frame description data, and the calling layer frees it again, corrupting the decoder context in memory. This matters for AI/ML shops because FFmpeg with NVDEC is the default way GPU-accelerated pipelines decode video — multimodal training-data ingestion, video-understanding inference, and automated content-moderation transcoding all commonly shell out to it. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so nothing indicates active exploitation, but the CVSS 8.8 (network vector, low complexity, no privileges, only user interaction) means a single crafted video file handed to a user or an automated ingestion job is enough to trigger it. Patch to the fix at commit 4c6217477fc64305055b37d9d1d0d76d30e37f97 (or the next release past 8.1.2), and until then route untrusted video through software decoding instead of NVDEC hardware acceleration.

Sources: NVD VulnCheck FFmpeg ATLAS

What is the risk?

High-severity memory corruption (CVSS 8.8, C:H/I:H/A:H) but not a zero-click flaw — it requires a victim or automated process to open/decode the crafted file (UI:R) via the NVDEC hardware path specifically, which narrows exposure to systems that enable GPU-accelerated decoding. No EPSS score, no CISA KEV entry, and no public exploit or scanner template exist, so near-term mass exploitation is unlikely today. However, the vulnerability class (double-free → potential arbitrary code execution) is a well-understood exploitation primitive, and any AI/ML service that automatically transcodes user-uploaded or scraped video on GPU infrastructure has a realistic, remotely-triggerable path to compromise once weaponized.

How does the attack unfold?

Delivery

Attacker delivers a crafted video file to a target via upload to an AI video-processing service, scraped training data, or direct user contact.

AML.T0049

Triggered decode

The victim application or user processes the file with FFmpeg using NVDEC hardware acceleration, satisfying the required user interaction.

AML.T0011

Memory corruption

Decoder surfaces are exhausted, triggering the ff_nvdec_start_frame_sep_ref error path to double-free the frame description data and corrupt the decoder context.

Impact

The corrupted memory causes a crash (denial of service) or, with heap grooming, arbitrary code execution in the GPU decode process, compromising the AI pipeline host.

AML.T0048

Delivery

Attacker delivers a crafted video file to a target via upload to an AI video-processing service, scraped training data, or direct user contact.

AML.T0049

Triggered decode

The victim application or user processes the file with FFmpeg using NVDEC hardware acceleration, satisfying the required user interaction.

AML.T0011

Memory corruption

Decoder surfaces are exhausted, triggering the ff_nvdec_start_frame_sep_ref error path to double-free the frame description data and corrupt the decoder context.

Impact

The corrupted memory causes a crash (denial of service) or, with heap grooming, arbitrary code execution in the GPU decode process, compromising the AI pipeline host.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
FFmpeg	—	—	No patch

Do you use FFmpeg? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade FFmpeg to a version past 8.1.2 incorporating patch commit 4c6217477fc64305055b37d9d1d0d76d30e37f97, or cherry-pick that fix if pinned to an older build. Until patched, disable NVDEC hardware-accelerated decoding for untrusted or user-supplied video (fall back to software decode) or gate hardware decode behind strict input validation/allow-listed codecs. Run video-processing workers in isolated, unprivileged containers with seccomp/AppArmor profiles and memory-safety mitigations (ASLR, hardened allocator) to blunt exploitation attempts. Detection: monitor FFmpeg/NVDEC worker processes for unexpected crashes, segfaults, or GPU decoder resets correlated with specific input files, and log/alert on repeated decoder-surface-exhaustion conditions.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution DoS Inference Training Data AML.T0010.001 - AI Software AML.T0011 - User Execution

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.3 - Third-party and supplier relationships

NIST AI RMF

GOVERN 6.1 - Policies and procedures address AI risks from third-party components and data

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-64832?

FFmpeg's NVIDIA NVDEC hardware decoder has a double-free flaw (CWE-415) in libavcodec/nvdec.c: when the GPU runs out of decoder surfaces, the ff_nvdec_start_frame_sep_ref error path frees the frame description data, and the calling layer frees it again, corrupting the decoder context in memory. This matters for AI/ML shops because FFmpeg with NVDEC is the default way GPU-accelerated pipelines decode video — multimodal training-data ingestion, video-understanding inference, and automated content-moderation transcoding all commonly shell out to it. There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so nothing indicates active exploitation, but the CVSS 8.8 (network vector, low complexity, no privileges, only user interaction) means a single crafted video file handed to a user or an automated ingestion job is enough to trigger it. Patch to the fix at commit 4c6217477fc64305055b37d9d1d0d76d30e37f97 (or the next release past 8.1.2), and until then route untrusted video through software decoding instead of NVDEC hardware acceleration.

Is CVE-2026-64832 actively exploited?

No confirmed active exploitation of CVE-2026-64832 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-64832?

Upgrade FFmpeg to a version past 8.1.2 incorporating patch commit 4c6217477fc64305055b37d9d1d0d76d30e37f97, or cherry-pick that fix if pinned to an older build. Until patched, disable NVDEC hardware-accelerated decoding for untrusted or user-supplied video (fall back to software decode) or gate hardware decode behind strict input validation/allow-listed codecs. Run video-processing workers in isolated, unprivileged containers with seccomp/AppArmor profiles and memory-safety mitigations (ASLR, hardened allocator) to blunt exploitation attempts. Detection: monitor FFmpeg/NVDEC worker processes for unexpected crashes, segfaults, or GPU decoder resets correlated with specific input files, and log/alert on repeated decoder-surface-exhaustion conditions.

What systems are affected by CVE-2026-64832?

This vulnerability affects the following AI/ML architecture patterns: video preprocessing pipelines, multimodal training data ingestion, GPU-accelerated model inference infrastructure, content moderation pipelines.

What is the CVSS score for CVE-2026-64832?

CVE-2026-64832 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

video preprocessing pipelinesmultimodal training data ingestionGPU-accelerated model inference infrastructurecontent moderation pipelines

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011 User Execution

Compliance Controls Affected

ISO 42001: A.6.2.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.

Exploitation Scenario

An attacker crafts a video file engineered to exhaust available NVDEC decoder surfaces (e.g., unusual reference-frame patterns or high concurrent decode load) and delivers it through a channel that reaches an AI pipeline's GPU decode path — uploading it to a video-analysis SaaS feature, submitting it as 'training data' scraped from the web, or sending it to a user whose desktop app shells out to FFmpeg with NVDEC enabled. When decoder surfaces run out, the double-free in the error path corrupts heap memory in the decoding process; with heap grooming this can escalate from a crash to arbitrary code execution in the context of the GPU worker, giving the attacker a foothold on the AI infrastructure host or, at minimum, a reliable denial-of-service against the video-ingestion pipeline.

Weaknesses (CWE)

CWE-415 Double Free

CWE-415 — Double Free: The product calls free() twice on the same memory address.

[Architecture and Design] Choose a language that provides automatic memory management.
[Implementation] Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.

Source: MITRE CWE corpus.