FFmpeg versions 4.4 through 8.1.2 contain a double‑free flaw in the NVIDIA NVDEC hardware decoder, identified as CWE-415. The bug manifests when the decoder's error path frees the frame description data twice, first through nvdec_fdd_priv_free and then by the calling layer. This double‑free corrupts the underlying decoder context memory and can allow an attacker to execute arbitrary code or crash the application that uses FFmpeg’s NVDEC accelerated decoding.

Any installation of FFmpeg 4.4 up to and including 8.1.2 running on FFmpeg and invoking NVDEC decoding with user‑supplied video inputs are at risk.

The CVSS score of 8.7 indicates a high severity and potential to compromise confidentiality, integrity, and availability. The EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploit yet. The likely attack vector is local or remote delivery of a crafted video file that triggers the double‑free when a video stream is processed. Exploitation requires the attacker to supply the malicious file to a running FFmpeg instance that uses NVDEC accelerated decoding.