CVE-2026-82821
Received Received - Intake

Null Pointer Dereference in FLVMeta AMF Object Parsing

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A vulnerability was determined in FLVMeta up to 1.2.2. Affected by this vulnerability is the function amf_object_get of the file src/amf.c of the component AMF Object Parsing. This manipulation causes null pointer dereference. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 52642f7dfb76ec7334016622dde60b1ae963d79b. To fix this issue, it is recommended to deploy a patch. The project maintainer doubts the security impact: "While I acknowledged the bugs and provided fixes, I have yet to see any way to exploit these alleged vulnerabilities."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82821
EUVD
EUVD-2026-68724

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
noirotm flvmeta to 1.2.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a null pointer dereference flaw in FLVMeta up to version 1.2.2. It occurs in the amf_object_get function within src/amf.c during AMF object parsing. When processing malformed FLV files, the function fails to validate an object pointer before dereferencing it, leading to a segmentation fault (SIGSEGV). The attack can be triggered remotely via a crafted FLV file.

Detection Guidance

To detect this vulnerability, monitor for segmentation faults (SIGSEGV) in flvmeta when processing FLV files. Use tools like gdb to trace crashes in flvmeta when handling malformed AMF data. Check logs for null pointer dereference errors during AMF object parsing.

Impact Analysis

This vulnerability can cause a program crash (segmentation fault) when processing malicious FLV files. While it does not directly lead to code execution or data theft, it may disrupt services relying on FLVMeta for media processing. The impact is limited to denial-of-service conditions.

Compliance Impact

This vulnerability, a null pointer dereference in FLVMeta, primarily causes application crashes but does not directly lead to data breaches or unauthorized access. It may impact compliance indirectly by causing service disruptions or data processing failures, which could violate availability requirements in GDPR or HIPAA. However, the vulnerability's limited scope and lack of demonstrated exploitability for data theft suggest minimal direct impact on compliance with these standards.

Mitigation Strategies

Immediately update flvmeta to the patched version using the commit 52642f7dfb76ec7334016622dde60b1ae963d79b. Avoid processing untrusted FLV files until patched. Monitor for crashes in flvmeta as a potential indicator of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82821. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart