CVE-2026-82820
MediumCVSS 4.3Summary
A vulnerability was found in FLVMeta up to 1.2.2 in the function amf_string_new in src/amf.c during AMF string processing. Manipulation of the length argument results in a heap-based buffer overflow. The attack can be launched remotely, and the exploit has been made public.
Risk Assessment
The heap-based buffer overflow could allow remote code execution or cause application crashes. Applying the patch is strongly recommended.
Recommendation
Apply the patch named f412a33b9a84c2d1a9dee145a868feddbf64879e to remediate the vulnerability.
Other vulnerabilities in FLVMeta
See all- CVE-2026-82821Medium
A vulnerability was found in FLVMeta up to 1.2.2 in the function amf_object_get in src/amf.c during AMF object parsing. The manipulation causes a null pointer dereference. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2023-36243High
FLVMeta v1.2.1 was found to contain a buffer overflow in the xml_on_metadata_tag_only function at dump_xml.c.
Original NVD description (English source)
A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amf_string_new of the file src/amf.c of the component AMF String Processing. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as f412a33b9a84c2d1a9dee145a868feddbf64879e. A patch should be applied to remediate this issue. The project maintainer doubts the security impact: "While I acknowledged the bugs and provided fixes, I have yet to see any way to exploit these alleged vulnerabilities."