CyberRota Analysis
AI-GeneratedFFmpeg versions 8.0 through 8.1.2 are vulnerable to a stack buffer overflow in the Vulkan HEVC hardware decoder, which can be exploited by remote attackers through specially crafted HEVC/H.265 bitstreams. This vulnerability allows attackers to overwrite return addresses and adjacent stack frames, potentially leading to arbitrary code execution. Organizations utilizing FFmpeg for media processing, especially those handling untrusted video streams, should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.
Related CVEs
Other vulnerabilities affecting the same vendor(s)