Executive brief
FFmpeg is a widely used multimedia framework for processing audio and video files. A vulnerability in its Vulkan-based video decoding component could allow an attacker to execute malicious code if a user opens a specially crafted video file. This could lead to a full system compromise or unauthorized access to sensitive data.
Technical details
A stack-based buffer overflow exists in the 'vk_hevc_end_frame' function within 'libavcodec/vulkan_hevc.c'. The vulnerability is caused by insufficient validation of the 'vps_num_hrd_parameters' value in an HEVC/H.265 bitstream. When this value exceeds the 'HEVC_MAX_SUB_LAYERS' constant, the 'set_vps' function overflows a fixed-size stack-allocated array ('vkvps_ps'). A remote attacker can exploit this by providing a malicious video file in any supported container format, allowing them to overwrite return addresses and stack frames to achieve arbitrary code execution. The issue was addressed by adding a bounds check in the Vulkan HEVC decoder path.
Affected products
- FFmpeg FFmpeg 8.0 through 8.1.2
Timeline
- 2026-06-30: other: Fix committed to FFmpeg master branch
- 2026-07-05: patched: Fix merged into master branch
- 2026-07-22: disclosed: CVE published and NVD record created