A high-severity double free vulnerability in the FFmpeg NVDEC hardware decoder exposes systems to potential remote code execution.

This is a double free vulnerability (CWE-415) triggered within the NVDEC hardware decoder. The attacker is unauthenticated and requires user interaction to process a malicious file to trigger the flaw.

Successful exploitation of this vulnerability can lead to memory corruption, potentially resulting in arbitrary code execution or a denial of service condition. Given the CVSS score of 8.8, the impact is considered high, as it threatens the confidentiality, integrity, and availability of any system processing untrusted media files using the affected FFmpeg components.

Immediate Action: Review the official FFmpeg repository for the identified commit (4c6217477fc64305055b37d9d1d0d76d30e37f97) and apply the latest stable release or backported patch.

Proactive Monitoring: Monitor application logs for unexpected crashes or errors associated with the FFmpeg decoding process, especially when handling files from external sources.

Compensating Controls: Implement strict input validation or sandboxing for any services that utilize FFmpeg to process user-supplied media files to limit the reach of an exploit.

Public Exploit Available: Unknown

Organizations relying on FFmpeg for media processing should prioritize updating to a patched version as soon as it becomes available. Due to the high risk of code execution, restricting the processing of media from untrusted sources is recommended until the patch is verified and deployed.