{
  "cveId": "CVE-2026-64831",
  "url": "https://patchblox.com/security/cve/CVE-2026-64831",
  "summary": "CVE-2026-64831 is fixed in 14 products on 1 platform, first by DEBIAN-CVE-2026-64831, released July 22, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "ffmpeg: FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder...",
  "description": "FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.",
  "published": "2026-07-22T10:16:00Z",
  "severity": "Medium",
  "epss": 0.00851,
  "epssPercentile": 0.58457,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "ffmpeg",
      "release": "Debian 14",
      "fixedVersion": "7:9.0.2-1",
      "fix": "DEBIAN-CVE-2026-64831",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64831",
      "released": "2026-07-22T17:16:58Z"
    },
    {
      "platform": "linux",
      "product": "ffmpeg",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "7:8.0.1-3ubuntu2\u002Besm4",
      "fix": "ffmpeg 7:8.0.1-3ubuntu2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-ffmpeg-7-8.0.1-3ubuntu2-esm4",
      "released": "2026-08-19T10:21:00Z"
    },
    {
      "platform": "linux",
      "product": "libavcodec-extra",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "7:8.0.1-3ubuntu2\u002Besm4",
      "fix": "libavcodec-extra 7:8.0.1-3ubuntu2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libavcodec-extra-7-8.0.1-3ubuntu2-esm4",
      "released": "2026-08-19T10:21:00Z"
    },
    {
      "platform": "linux",
      "product": "libavcodec-extra62",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "7:8.0.1-3ubuntu2\u002Besm4",
      "fix": "libavcodec-extra62 7:8.0.1-3ubuntu2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libavcodec-extra62-7-8.0.1-3ubuntu2-esm4",
      "released": "2026-08-19T10:21:00Z"
    },
    {
      "platform": "linux",
      "product": "libavcodec62",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "7:8.0.1-3ubuntu2\u002Besm4",
      "fix": "libavcodec62 7:8.0.1-3ubuntu2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libavcodec62-7-8.0.1-3ubuntu2-esm4",
      "released": "2026-08-19T10:21:00Z"
    },
    {
      "platform": "linux",
      "product": "libavdevice62",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "7:8.0.1-3ubuntu2\u002Besm4",
      "fix": "libavdevice62 7:8.0.1-3ubuntu2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libavdevice62-7-8.0.1-3ubuntu2-esm4",
      "released": "2026-08-19T10:21:00Z"
    },
    {
      "platform": "linux",
      "product": "libavfilter-extra",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "7:8.0.1-3ubuntu2\u002Besm4",
      "fix": "libavfilter-extra 7:8.0.1-3ubuntu2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libavfilter-extra-7-8.0.1-3ubuntu2-esm4",
      "released": "2026-08-19T10:21:00Z"
    },
    {
      "platform": "linux",
      "product": "libavfilter-extra11",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "7:8.0.1-3ubuntu2\u002Besm4",
      "fix": "libavfilter-extra11 7:8.0.1-3ubuntu2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libavfilter-extra11-7-8.0.1-3ubuntu2-esm4",
      "released": "2026-08-19T10:21:00Z"
    },
    {
      "platform": "linux",
      "product": "libavfilter11",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "7:8.0.1-3ubuntu2\u002Besm4",
      "fix": "libavfilter11 7:8.0.1-3ubuntu2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libavfilter11-7-8.0.1-3ubuntu2-esm4",
      "released": "2026-08-19T10:21:00Z"
    },
    {
      "platform": "linux",
      "product": "libavformat-extra",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "7:8.0.1-3ubuntu2\u002Besm4",
      "fix": "libavformat-extra 7:8.0.1-3ubuntu2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libavformat-extra-7-8.0.1-3ubuntu2-esm4",
      "released": "2026-08-19T10:21:00Z"
    },
    {
      "platform": "linux",
      "product": "libavformat-extra62",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "7:8.0.1-3ubuntu2\u002Besm4",
      "fix": "libavformat-extra62 7:8.0.1-3ubuntu2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libavformat-extra62-7-8.0.1-3ubuntu2-esm4",
      "released": "2026-08-19T10:21:00Z"
    },
    {
      "platform": "linux",
      "product": "libavformat62",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "7:8.0.1-3ubuntu2\u002Besm4",
      "fix": "libavformat62 7:8.0.1-3ubuntu2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libavformat62-7-8.0.1-3ubuntu2-esm4",
      "released": "2026-08-19T10:21:00Z"
    },
    {
      "platform": "linux",
      "product": "libavutil60",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "7:8.0.1-3ubuntu2\u002Besm4",
      "fix": "libavutil60 7:8.0.1-3ubuntu2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libavutil60-7-8.0.1-3ubuntu2-esm4",
      "released": "2026-08-19T10:21:00Z"
    },
    {
      "platform": "linux",
      "product": "libswresample6",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "7:8.0.1-3ubuntu2\u002Besm4",
      "fix": "libswresample6 7:8.0.1-3ubuntu2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libswresample6-7-8.0.1-3ubuntu2-esm4",
      "released": "2026-08-19T10:21:00Z"
    },
    {
      "platform": "linux",
      "product": "libswscale9",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "7:8.0.1-3ubuntu2\u002Besm4",
      "fix": "libswscale9 7:8.0.1-3ubuntu2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-libswscale9-7-8.0.1-3ubuntu2-esm4",
      "released": "2026-08-19T10:21:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}