CVE-2026-82820
Received Received - Intake

Heap-based Buffer Overflow in FLVMeta AMF String Processing

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amf_string_new of the file src/amf.c of the component AMF String Processing. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as f412a33b9a84c2d1a9dee145a868feddbf64879e. A patch should be applied to remediate this issue. The project maintainer doubts the security impact: "While I acknowledged the bugs and provided fixes, I have yet to see any way to exploit these alleged vulnerabilities."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82820
EUVD
EUVD-2026-68721

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
noirotm flvmeta to 1.2.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap-based buffer overflow in FLVMeta up to version 1.2.2. It occurs in the amf_string_new function of the src/amf.c file. The issue arises when the function processes the length argument incorrectly, leading to memory corruption. The attack can be launched remotely, and a public exploit exists.

Detection Guidance

To detect this vulnerability, inspect FLV files processed by flvmeta 1.2.2 or earlier for crashes or memory corruption when using the amf_string_new function. Check logs for heap-based buffer overflow errors. Use static analysis tools to examine the amf.c file for improper length handling in string operations.

Impact Analysis

The vulnerability could allow remote attackers to cause program crashes or execute arbitrary code by exploiting specially crafted FLV files. This may lead to denial-of-service conditions or unauthorized system access, depending on the application's context and privileges.

Compliance Impact

This vulnerability involves a heap-based buffer overflow in FLVMeta due to incorrect memory handling in AMF string processing. While it could lead to program crashes or undefined behavior, the maintainer disputes its exploitability. No direct impact on GDPR or HIPAA compliance is specified, as these standards focus on data protection and privacy rather than memory safety vulnerabilities.

Mitigation Strategies

Apply the patch from commit f412a33b9a84c2d1a9dee145a868feddbf64879e to update flvmeta to a patched version. Avoid processing untrusted FLV files with vulnerable versions. Monitor for crashes or memory corruption in flvmeta processes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82820. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart