CVE-2018-20199

Name of the Vulnerable Software and Affected Versions Freeware Advanced Audio Decoder 2 (FAAD2) version 2.8.8

Description The issue is related to a NULL pointer dereference in the ifilter bank function of the libfaad/filtbank.c component of the Freeware Advanced Audio Decoder 2 (FAAD2) audio decoder. This can be exploited by a remote attacker to cause a denial of service, resulting in an application crash due to a segmentation fault. The crash occurs because adding to windowed output is mishandled in the ONLY LONG SEQUENCE case.

Recommendations For Freeware Advanced Audio Decoder 2 (FAAD2) version 2.8.8, consider disabling the ifilter bank function as a temporary workaround until a patch is available to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.