CVE-2018-20360

Name of the Vulnerable Software and Affected Versions Freeware Advanced Audio Decoder 2 (FAAD2) version 2.8.8

Description The issue is related to the incorrect handling of a new PS channel in the sbr process channel function of the libfaad/sbr dec.c component of the FAAD2 audio decoder. This allows a remote attacker to cause a denial of service. The vulnerability causes a segmentation fault and application crash.

Recommendations For version 2.8.8, consider disabling the sbr process channel function as a temporary workaround until a patch is available. Restrict access to the libfaad/sbr dec.c component to minimize the risk of exploitation. Avoid using the affected audio decoder until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.