CVE Watch22 jul 2026

CVE-2026-64832

FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that al

CVSS

8.8

Alto

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 22 jul 2026 · Última mod.: 22 jul 2026 · CWE-415

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-646217.3 ALT

14.6%

——4FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings object, and a raw non-owning pointer to it is freed on the strtoul error path without clearing settings->MonitorIds, leaving it dangling; at teardown freerdp_settings_free() frees the same buffer again. An attacker who convinces a victim to open a crafted .rdp file with oversized monitor tokens can trigger a size-controlled double-free in any FreeRDP CLI client (xfreerdp/sdl-freerdp/wlfreerdp) in the default configuration.3d CVE-2026-137136.2 MED

3.9%

——1YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it. Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.6d CVE-2026-551327.8 ALT

30.2%

——9Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally.7d CVE-2026-506857.5 ALT

46.0%

——14Double free in Windows DHCP Server allows an authorized attacker to execute code over a network.1d CVE-2026-503617.8 ALT

8.2%

——2Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.11h CVE-2026-550047.8 ALT

15.9%

——5Double free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.11h