FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder
    within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video
    file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via
    nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting
    in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-
    accelerated decoding. (CVE-2026-64832)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3e109a0c85 advisory.

    Latest upstream bugfix release from 8.1 branch. Changes:
    https://code.ffmpeg.org/FFmpeg/FFmpeg/src/branch/release/8.1/Changelog .























Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-040732b5dc advisory.

    Latest FFmpeg stable release and rebuilds of dependent packages. Fixes a number of high severity security     bugs:
    CVE-2026-64832 CVE-2026-70628 CVE-2026-70632 CVE-2026-75147 CVE-2026-75146 .

    Includes:

    * icecat release 140.16.0
    * wivrn v26.9, which fixes install of the APK via the dashboard.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8716-1 advisory.

    It was discovered that FFmpeg incorrectly handled certain crafted media files in the VobSub subtitle     demuxer. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2026-64830)

    It was discovered that FFmpeg incorrectly handled certain crafted DTS audio streams in the S/PDIF muxer.
    An attacker could possibly use this issue to cause a denial of service or expose sensitive information.
    (CVE-2026-64833)

    It was discovered that FFmpeg incorrectly handled certain crafted RTP/ASF streams. An attacker could     possibly use this issue to cause a denial of service. (CVE-2026-64834)

    It was discovered that FFmpeg incorrectly handled certain crafted ADX audio files. This issue only     affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-64835)

    It was discovered that FFmpeg incorrectly handled certain crafted AVI files in the TDSC video decoder. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2026-65703)

    It was discovered that FFmpeg incorrectly handled certain crafted ffconcat files processed via the TY     demuxer. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.
    (CVE-2026-65704)

    It was discovered that FFmpeg incorrectly handled certain crafted video streams in the vf_floodfill video     filter. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04     LTS. (CVE-2026-65705)

    It was discovered that FFmpeg incorrectly handled certain crafted NV12 video frames in the vf_swaprect     video filter. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu     24.04 LTS. (CVE-2026-65706)

    It was discovered that FFmpeg incorrectly handled certain crafted hvcC NAL arrays in the HEVC parser. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2026-75141)

    It was discovered that FFmpeg incorrectly handled certain crafted MPEG system headers. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-75142)

    It was discovered that FFmpeg incorrectly handled certain crafted network input in the librist protocol     handler. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-75143)

    It was discovered that FFmpeg incorrectly handled certain crafted Dirac data units in the VC2 HQ RTP     packetizer. An attacker could possibly use this issue to cause a denial of service or execute arbitrary     code. (CVE-2026-75144)

    It was discovered that FFmpeg incorrectly handled certain crafted DASH manifests. This issue only affected     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-75146)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21572-1 advisory.

    - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer (bsc#1272752).
    - CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec.c (bsc#1272754).
    - CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder (bsc#1272758).
    - CVE-2026-66038: LCL/ZLIB Video Decoder Information Disclosure via lcldec.c (bsc#1272768).
    - CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (bsc#1272765).
    - CVE-2026-66041: Heap Out-of-Bounds Write via vf_quirc Filter (bsc#1272767).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3542-1 advisory.

    Update to release 4.4.8.

    - CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code     execution       (bsc#1269490).
    - CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of service     (bsc#1268595).
    - CVE-2026-64830: heap buffer overflow in the VobSub subtitle demuxer can lead to arbitrary code execution       (bsc#1272752).
    - CVE-2026-64832: double-free in the NVIDIA NVDEC hardware decoder can lead to can lead to memory     corruption       (bsc#1272754).
    - CVE-2026-64835: out-of-bounds memory access in the ADX audio decoder can lead to information disclosure     and memory       corruption (bsc#1272758).
    - CVE-2026-66038: exposure of uninitialized heap memory by the LCL/ZLIB video decoder can lead to     sensitive information       disclosure (bsc#1272768).
    - CVE-2026-66039: signed integer overflow in the MACE6 audio decoder can lead to heap corruption and     arbitrary code       execution (bsc#1272765).

    Other updates and bugfixes:

    - Release 4.4.8
      * Various bug fixes to codecs
      * avcodec/magicyuv: Fix 1 line MEDIAN slices
      * avcodec/magicyuv: Expand the s->interlaced slice-height sanity check
      * avcodec/magicyuv: reject slice_height misaligned with chroma vshift

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3529-1 advisory.

    Update to release 4.4.8.

    - CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code     execution       (bsc#1269490).
    - CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of service     (bsc#1268595).
    - CVE-2026-64830: heap buffer overflow in the VobSub subtitle demuxer can lead to arbitrary code execution       (bsc#1272752).
    - CVE-2026-64832: double-free in the NVIDIA NVDEC hardware decoder can lead to can lead to memory     corruption       (bsc#1272754).
    - CVE-2026-64835: out-of-bounds memory access in the ADX audio decoder can lead to information disclosure     and memory       corruption (bsc#1272758).
    - CVE-2026-66038: exposure of uninitialized heap memory by the LCL/ZLIB video decoder can lead to     sensitive information       disclosure (bsc#1272768).
    - CVE-2026-66039: signed integer overflow in the MACE6 audio decoder can lead to heap corruption and     arbitrary code       execution (bsc#1272765).

    Other updates and bugfixes:

    - Release 4.4.8
      * Various bug fixes to codecs
      * avcodec/magicyuv: Fix 1 line MEDIAN slices
      * avcodec/magicyuv: Expand the s->interlaced slice-height sanity check
      * avcodec/magicyuv: reject slice_height misaligned with chroma vshift

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21522-1 advisory.

    Changes in ffmpeg-4:

    - CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder (bsc#1272758)
    - CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec.c (bsc#1272754)
    - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer (bsc#1272752)
    - CVE-2026-66038: LCL/ZLIB Video Decoder Information Disclosure via lcldec.c (bsc#1272768)
    - CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (bsc#1272765)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder     within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video     file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via     nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting     in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-     accelerated decoding. (CVE-2026-64832)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
465911	Echo: ffmpeg: security update to 7:7.1.5-0+deb13u1+e2	Tenable Cloud Security	Echo Local Security Checks	Local	high
465911	Echo: ffmpeg: security update to 7:7.1.5-0+deb13u1+e2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
358433	Fedora 44 : ffmpeg (2026-3e109a0c85)	Nessus	Fedora Local Security Checks	Local	critical
349770	Fedora 45 : OpenBoard / Pencil2D / alsa-plugins / amarok / aqualung / atomes / etc (2026-040732b5dc)	Nessus	Fedora Local Security Checks	Local	high
344622	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : FFmpeg vulnerabilities (USN-8716-1)	Nessus	Ubuntu Local Security Checks	Local	critical
335498	openSUSE 16: ffmpeg-7 / ffmpeg-7-libavcodec-devel / ffmpeg-7-libavdevice-devel / etc (openSUSE-SU-2026:21572-1)	Nessus	SuSE Local Security Checks	Local	high
334789	SUSE SLED15: ffmpeg-4 / ffmpeg-4-libavcodec-devel / ffmpeg-4-libavdevice-devel / etc (SUSE-SU-2026:3542-1)	Nessus	SuSE Local Security Checks	Local	high
333552	SUSE SLES15: libavcodec58_134 / libavformat58_76 / libavutil56_70 / etc (SUSE-SU-2026:3529-1)	Nessus	SuSE Local Security Checks	Local	high
332106	openSUSE 16: ffmpeg-4 / ffmpeg-4-libavcodec-devel / ffmpeg-4-libavdevice-devel / etc (openSUSE-SU-2026:21522-1)	Nessus	SuSE Local Security Checks	Local	high
329564	Linux Distros Unpatched Vulnerability : CVE-2026-64832	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-64832

high

Tenable Plugins

high

high

critical

high

critical

high

high

high

high

high