GPU VulnDB

Database/NVIDIA / GPU stack

FFmpeg NVDEC: double-free on decoder-surface exhaustion gives memory corruption from a crafted video

CVSS 8.7CVE-2026-64832NVIDIA / GPU stackcurated

Impact

In FFmpeg 4.4 through 8.1.2, when no NVDEC decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees the frame description data through nvdec_fdd_priv_free while the calling layer frees the same data again, double-freeing the decoder context. Any FFmpeg-based application using NVIDIA hardware-accelerated decoding is affected, which on a GPU fleet means transcode and video-ingest pipelines that accept third-party media. The consequence is heap corruption inside a process that already holds a CUDA context on the GPU, so the realistic outcomes are process compromise and a wedged decode pipeline on that device. Note that the surface-exhaustion precondition makes this easier to hit on a busy node running many concurrent decode sessions. The record does not demonstrate escape from the process to the driver or to other tenants.

Who can reach it

Anyone who can get a crafted video file into an NVDEC-backed FFmpeg decode path - a transcode queue, a media upload, a dataset preprocessing job. No authentication beyond whatever gates submission; the vector requires the file to be processed.

What to do

Update FFmpeg to a build containing commit 4c6217477fc64305055b37d9d1d0d76d30e37f97 (upstream PR 23664) and restart the transcode or ingest daemons - the fix is in userspace, so no GPU driver change, node drain or reboot is needed. The record names no released fixed version; if your distribution has not shipped it, rebuild or fall back to software decoding (drop -hwaccel cuda/cuvid) for untrusted input. Container images that bundle their own FFmpeg must be rebuilt, not just restarted.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-64832https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.