Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

FAAD2 2.7 can be crashed by malicious MP4 file

CVE-2017-9253 · published 9 years ago
Summary

The free audio decoder FAAD2 version 2.7 can be forced to consume excessive CPU and stop working when it processes a specially crafted MP4 file. An attacker who can send such a file to your system could make the decoder unusable, impacting any service that relies on it. Apply the latest update from the vendor or stop handling untrusted MP4 files until the issue is fixed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
audiocoding freeware_advanced_audio_decoder_2 2.7
cpe:2.3:a:audiocoding:freeware_advanced_audio_decoder_2:2.7:*:*:*:*:*:*:*
Original advisory text
The mp4ff_read_stsd function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a c...
The mp4ff_read_stsd function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted mp4 file.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-834Excessive Iteration
Timeline
Published27 Jun 2017
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-9253 · NVD
Track software like this
Free during beta