CVE-2018-20362

Name of the Vulnerable Software and Affected Versions Freeware Advanced Audio Decoder 2 (FAAD2) version 2.8.8

Description A NULL pointer dereference was discovered in the ifilter bank function of libfaad/filtbank.c. This issue causes a segmentation fault and application crash due to mishandling of adding to windowed output in the EIGHT SHORT SEQUENCE case. The vulnerability can be exploited by a remote attacker to cause a denial of service when processing the EIGHT SHORT SEQUENCE case.

Recommendations For Freeware Advanced Audio Decoder 2 (FAAD2) version 2.8.8, consider disabling the ifilter bank function in libfaad/filtbank.c as a temporary workaround to prevent exploitation. However, at the moment, there is no information about a newer version that contains a fix for this vulnerability.