diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64831.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64831.patch
new file mode 100644
index 0000000000..29218b3608
--- /dev/null
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64831.patch
@@ -0,0 +1,36 @@
+From 60044ad2b2dbd9a728a1471b0e36eed3157a6ad5 Mon Sep 17 00:00:00 2001
+From: Pavel Kohout <disclosure@aisle.com>
+Date: Tue, 30 Jun 2026 21:55:49 +0200
+Subject: [PATCH] avcodec/vulkan_hevc: reject too many VPS HRD parameter sets
+
+Fixes: stack buffer overflow
+Fixes: tD7Mj0ST7ND3
+Fixes: 82864c21112157951ce91b4430a9018edd02f5ab (vulkan_hevc: use VK_KHR_video_maintenance2 if available)
+Found-by: Pavel Kohout (Aisle Research)
+Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
+
+CVE: CVE-2026-64831
+Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed]
+
+Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
+---
+ libavcodec/vulkan_hevc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/libavcodec/vulkan_hevc.c b/libavcodec/vulkan_hevc.c
+index 5e15c6b931..34676113a9 100644
+--- a/libavcodec/vulkan_hevc.c
++++ b/libavcodec/vulkan_hevc.c
+@@ -875,6 +875,9 @@ static int vk_hevc_end_frame(AVCodecContext *avctx)
+                 vksps_p.vcl_hdr, &vksps_p.ptl, &vksps_p.dpbm,
+                 &vksps_p.pal, vksps_p.str, &vksps_p.ltr);
+ 
++        if (sps->vps->vps_num_hrd_parameters > HEVC_MAX_SUB_LAYERS)
++            return AVERROR_INVALIDDATA;
++
+         vkvps_p.sls = vkvps_ps;
+         set_vps(sps->vps, &vkvps, &vkvps_p.ptl, &vkvps_p.dpbm,
+                 vkvps_p.hdr, vkvps_p.sls);
+-- 
+2.43.0
+
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb
index 8c1969369b..02b9cf65a5 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb
@@ -27,6 +27,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \
            file://0001-ffbuild-commonmak-Consolidate-pattern-rules-for-comp.patch \
            file://0002-ffbuild-common.mak-ensure-target-directories-are-cre.patch \
            file://CVE-2026-64830.patch \
+           file://CVE-2026-64831.patch \
            "
 
 SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818"