CVE-2026-82821: FLVMeta AMF Object Parsing amf.c amf_object_get null pointer dereference
A vulnerability was determined in FLVMeta up to 1.2.2. Affected by this vulnerability is the function amfobjectget of the file src/amf.c of the component AMF Object Parsing. This manipulation causes null pointer dereference. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 52642f7dfb76ec7334016622dde60b1ae963d79b. To fix this issue, it is recommended to deploy a patch. The project maintainer doubts the security impact: "While I acknowledged the bugs and provided fixes, I have yet to see any way to exploit these alleged vulnerabilities."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 52642f7dfb76ec7334016622dde60b1ae963d79b
Event History
Frequently Asked Questions
Which deployments are affected?
FLVMeta versions up to and including 1.2.2 are identified as affected. The issue is in AMF object parsing, specifically the amf_object_get function in src/amf.c.
What does an attacker need to exploit this issue?
The attack can be initiated remotely and requires user interaction. No privileges are required according to the supplied severity vector.
Is exploit code available?
Yes. The exploit has been publicly disclosed and may be used.
What remediation is available?
Deploy the fix identified by patch commit 52642f7dfb76ec7334016622dde60b1ae963d79b. The provided data does not specify an affected configuration workaround if patching cannot be performed immediately.