CyberRota Analysis
AI-GeneratedFFmpeg versions 4.4 through 8.1.2 are vulnerable due to a double-free vulnerability in the NVIDIA NVDEC hardware decoder, which can be exploited by attackers through specially crafted video files, leading to memory corruption. This issue can compromise the stability and security of any application utilizing FFmpeg for NVDEC hardware-accelerated decoding. Organizations using FFmpeg for video processing should prioritize patching to mitigate potential exploitation risks.
Original NVD Description
FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.
Related CVEs
Other vulnerabilities affecting the same vendor(s)