Cyber Resilience

CVE-2026-64831

Memory Safety in Ffmpeg 8.0 – 8.1.2

Public PoCMemory Safety
Published
22 July 2026
Modified
28 July 2026
Patch / advisory
View advisory
CVSS Score v4 8.7
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0046 37th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-64831 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Ffmpeg Ffmpeg. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 37th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-16 (Memory Protection) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious…

more

vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.

CWE(s)
CWE-121

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
attack.mitre.org →
Why these techniques?

Stack buffer overflow in media decoder directly enables client-side RCE via crafted HEVC bitstream (malicious file).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1203 Exploitation for Client Execution Executionconfidence: HIGH
Stack buffer overflow in media decoder enables remote code execution via crafted HEVC bitstream in client applications.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-64832Same product: Ffmpeg Ffmpeg
CVE-2026-64830Same product: Ffmpeg Ffmpeg
CVE-2024-35365Same product: Ffmpeg Ffmpeg
CVE-2025-1594Same product: Ffmpeg Ffmpeg
CVE-2024-32228Same product: Ffmpeg Ffmpeg
CVE-2024-7055Same product: Ffmpeg Ffmpeg
CVE-2026-64835Same product: Ffmpeg Ffmpeg
CVE-2026-40962Same product: Ffmpeg Ffmpeg
CVE-2025-69693Same product: Ffmpeg Ffmpeg
CVE-2024-32230Same product: Ffmpeg Ffmpeg

Affected Assets

ffmpeg
ffmpeg
8.0 — 8.1.2

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SI-16 Memory Protection
  • CM-7 Least Functionality
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 2 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly enforces validation of untrusted HEVC bitstream fields (e.g., vps_num_hrd_parameters) before they reach vk_hevc_end_frame stack buffers.

SI-16 Memory Protection good match
prevent

Applies memory-protection mechanisms (stack canaries, ASLR, NX) that block return-address overwrites from the CWE-121 overflow in the Vulkan decoder.

CM-7 Least Functionality partial match
prevent

Disables or restricts the vulnerable Vulkan HEVC hardware decoder path, eliminating the attack surface for crafted bitstreams.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure-development practices directly prevent introduction of stack buffer overflows.

ID.RA-01 partial match
prevents

Vulnerability scanning can discover stack buffer overflows but does not prevent their introduction.

PR.PS-02 partial match
prevents

Patching eliminates known instances of the weakness after discovery.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing (fuzzing, static analysis) detects stack overflows before release.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC mandates buffer-safety practices that directly prevent stack overflows.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify buffer-size and input-validation rules.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles include memory-safety and least-privilege stack usage.

A.8.28 Secure coding partial match
prevents

Secure coding standards explicitly forbid unsafe buffer handling that causes CWE-121.

A.8.32 Change management none match
none

Change-management gates can enforce security reviews that catch buffer issues.

References