ECHO-18b0-99b8-3f51
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-18b0-99b8-3f51.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/ECHO-18b0-99b8-3f51
- Upstream
- Withdrawn
- 2026-07-26T15:15:03Z
- Published
- 2026-07-26T15:15:03Z
- Modified
- 2026-09-15T00:47:46Z
- Summary
- Vulnerability is in a Vulkan HEVC decoder code path that does not exist in this version. Refs: - https://security-tracker.debian.org/tracker/CVE-2026-64831 details: | The vulnerable code (a stack-allocated VPS/SPS parameter struct built per-frame in vk_hevc_end_frame(), overflowed by an unchecked vps_num_hrd_parameters) was introduced by upstream commit 82864c21 ("vulkan_hevc: use VK_KHR_video_maintenance2 if available", 2026-03-14) as part of a refactor that is not present in the 7.1.x branch. In this source, vk_hevc_end_frame() has no such stack buffer: VPS HRD parameters are built once into a heap buffer in alloc_hevc_header_structs()/set_vps(), whose destination arrays are bounded by HEVC_MAX_LAYER_SETS (1024), and vps_num_hrd_parameters is already bounded by vps_num_layer_sets (<=1024) at parse time in libavcodec/hevc/ps.c. The CVE's own affected-version range ("FFmpeg 8.0 through 8.1.2") is consistent with this. If this spec is ever bumped to >=8.0, this entry MUST be re-evaluated and likely converted into a real patch.
- Details
- References