Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-82820: flvmeta can be remotely crashed via malformed input

CVE-2026-82820 · published 2 months ago

Summary

Versions of flvmeta up to 1.2.2 mishandle a string length when processing AMF data, allowing a remote user to send specially crafted input that causes a memory overflow. This can make the program stop working and could be used to run unwanted code. Apply the latest update from the project to fix the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	–	flvmeta	1.2.0
Debian:11	debian	flvmeta	All versions
Debian:12	debian	flvmeta	All versions
Debian:13	debian	flvmeta	All versions
Debian:14	debian	flvmeta	All versions
Ubuntu:16.04:LTS	canonical	flvmeta	All versions

Original advisory text

FLVMeta AMF String Processing amf.c amf_string_new heap-based overflow

A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amf_string_new of the file src/amf.c of the component AMF String Processing. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as f412a33b9a84c2d1a9dee145a868feddbf64879e. A patch should be applied to remediate this issue. The project maintainer doubts the security impact: "While I acknowledged the bugs and provided fixes, I have yet to see any way to exploit these alleged vulnerabilities."

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82820... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-82820 Vendor Advisory
https://github.com/raind20001020/Poc/blob/main/flvmeta_heap_buffer_overflow Exploit
https://security-tracker.debian.org/tracker/CVE-2026-82820 Vendor Advisory
https://vuldb.com/submit/876596 Vendor Advisory
https://ubuntu.com/security/CVE-2026-82820 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-82820 Third Party Advisory
https://vuldb.com/cve/CVE-2026-82820 Vendor Advisory
https://vuldb.com/vuln/397243 Vendor Advisory
https://github.com/noirotm/flvmeta/issues/27 Third Party Advisory
https://vuldb.com/vuln/397243/cti Third Party Advisory
https://github.com/noirotm/flvmeta/commit/f412a33b9a84c2d1a9dee145a868feddbf6487... Patch

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

CWE-119Buffer Overflow

Timeline

Published31 Aug 2026

Updated4 Nov 2026

First seen31 Aug 2026

Sources

CVE-2026-82820 · NVD

CVE-2026-82820 · MITRE

DEBIAN-CVE-2026-82820 · OSV

CVE-2026-82820 · OSV

UBUNTU-CVE-2026-82820 · OSV

Track software like this

Free during beta