FFmpeg versions 8.0 through 8.1.2 contain a stack buffer overflow in the Vulkan HEVC hardware decoder. A crafted HEVC/H.265 bitstream that embeds a malicious vps_num_hrd_parameters value exceeding the HEVC_MAX_SUB_LAYERS limit can overflow stack‑allocated arrays in the vk_hevc_end_frame function, allowing an attacker to overwrite return addresses and adjacent stack frames. This weakness, identified as CWE‑121, can lead to arbitrary code execution when the vulnerable decoder processes such a malicious stream.

The flaw affects FFmpeg releases from 8.0 up to and including 8.1.2. All systems that employ these FFmpeg versions for media decoding—regardless of operating system—are potentially impacted because the vulnerability resides in the core library used by numerous multimedia applications.

The CVSS score of 8.7 indicates a high severity assessment. The EPSS score is reported as < 1 %, implying that exploitation is expected to be rare, but the remote nature of the flaw and the lack of a requirement for privileged access mean that an attacker who can supply a crafted HEVC/H.265 stream to the target can trigger the overflow. The vulnerability is not listed in the CISA KEV catalog, which suggests limited known exploitation but does not negate the risk of future attacks.