CVE-2026-64832 FFmpeg 4.4 - 8.1.2 Double-Free in NVDEC Hardware Decoder via nvdec.c

High 8.7 Published 22 Jul 2026 Updated 28 Jul 2026

Attackers can trigger memory corruption and potential code execution in FFmpeg applications using NVDEC hardware decoding by supplying a crafted video file.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-64832?

CVE-2026-64832 is a high-severity use after free vulnerability in Ffmpeg Ffmpeg, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.

Weakness: CWE-415

Which versions are affected by CVE-2026-64832?

It affects 1 product.

Products include Ffmpeg Ffmpeg.

How do I fix CVE-2026-64832?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-64832 being exploited?

There is no known exploitation of CVE-2026-64832 in the wild and no public exploit code.

All Ffmpeg Ffmpeg vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-64832, ECHO-7190-6b4d-bcce, GHSA-jc8j-9799-c943, JLSEC-2026-1174, MINI-x2cf-pm64-2f5r, UBUNTU-CVE-2026-64832.