Executive brief
FLVMeta is a tool used to analyze and manipulate metadata in FLV video files. A heap-based buffer overflow vulnerability exists in the AMF (Action Message Format) string processing code, allowing an attacker to crash the application or potentially execute arbitrary code by supplying a malformed FLV file with invalid metadata length values. This could allow remote attackers to cause a denial of service or compromise systems that process untrusted video files.
Technical details
The vulnerability is a heap-based buffer overflow in the amf_string_new() function within src/amf.c. The root cause is inconsistent memory allocation and usage: amf_data_clone() allocates a buffer via strdup() with size equal to the actual string length (e.g., 40 bytes), but amf_string_new() then attempts to copy data using memcpy() with a length parameter from the corrupted AMF metadata (e.g., 514 bytes). The function fails to validate that the declared length matches the allocated buffer size, leading to an out-of-bounds read. The vulnerability can be triggered remotely by processing a malformed FLV file with invalid AMF string metadata. The fix (commit f412a33) addresses the allocation logic in amf_data_clone() to respect the declared length rather than stopping at null terminators, and corrects the length used in memcpy().
Affected products
- FLVMeta FLVMeta up to 1.2.2
Timeline
- 2026-07-02: disclosed: Vulnerability reported on GitHub issue #27
- 2026-08-31: patched: Patch identified as commit f412a33b9a84c2d1a9dee145a868feddbf64879e
- 2026-08-31: advisory: CVE-2026-82820 published