CVE-2026-82820: FLVMeta Heap Buffer Overflow Vulnerability

CVE-2026-82820 Overview

CVE-2026-82820 is a heap-based buffer overflow in FLVMeta versions up to 1.2.2. The flaw resides in the amf_string_new function inside src/amf.c, part of the Action Message Format (AMF) String Processing component. Manipulation of the length argument triggers memory corruption on the heap [CWE-119].

A public proof-of-concept exists, and the project maintainer has published a fix in commit f412a33b9a84c2d1a9dee145a868feddbf64879e. The maintainer has publicly questioned the practical exploitability of the issue. The vulnerability carries a low severity rating, reflecting the requirement for user interaction and limited impact scope.

Critical Impact
Processing a malformed Flash Video (FLV) file with a vulnerable FLVMeta build can corrupt heap memory, potentially causing process crashes or unpredictable behavior in downstream media pipelines.

Affected Products

FLVMeta versions up to and including 1.2.2
The amf_string_new function in src/amf.c
The AMF String Processing component

Discovery Timeline

2026-08-31 - CVE-2026-82820 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82820

Vulnerability Analysis

FLVMeta is an open-source command-line utility for manipulating metadata in Flash Video (FLV) files. The vulnerability is a heap-based buffer overflow in the AMF (Action Message Format) string handling path. When amf_string_new is invoked to duplicate a string, the caller previously passed a pointer obtained from strdup together with a size derived from the source AMF object. Because the caller and the allocator disagree on the effective buffer boundary, the function can write past the allocated heap region.

The attack vector is remote in the sense that a crafted FLV file can be delivered over the network, but exploitation requires the victim to open the malicious file with FLVMeta. Successful triggering corrupts heap metadata, which can crash the process or degrade the availability of automated media-processing pipelines that use FLVMeta.

Root Cause

The root cause is unsafe ownership and size handling in the string constructor. The original amf_string_new signature accepted a mutable byte * and expected callers to pass a freshly duplicated buffer, decoupling the buffer from its true allocation size. When callers duplicated a string via strdup and passed a size taken from amf_string_get_size, mismatches between the duplicated buffer length and the declared size caused out-of-bounds writes into the heap.

Attack Vector

An attacker crafts an FLV file with malformed AMF string metadata and induces a user to process it with a vulnerable FLVMeta build. Because FLVMeta is often invoked automatically in video transcoding workflows, delivery can be as simple as uploading the file to a service that runs FLVMeta on ingest.

// Security patch in src/amf.c and src/amf.h
// Source: https://github.com/noirotm/flvmeta/commit/f412a33b9a84c2d1a9dee145a868feddbf64879e

// src/amf.h - signature hardened to accept a const source buffer
-amf_data * amf_string_new(byte * str, uint16 size);
+amf_data * amf_string_new(const byte * str, uint16 size);

// src/amf.c - remove the strdup path; copy directly from the source bytes
case AMF_TYPE_STRING:
-    if (data->string_data.mbstr != NULL) {
-        return amf_string_new((byte *)strdup((char *)amf_string_get_bytes(data)),
-                              amf_string_get_size(data));
-    }
-    else {
-        return amf_str(NULL);
+    {
+        const byte * s = amf_string_get_bytes(data);
+        if (s != NULL) {
+            return amf_string_new(s, amf_string_get_size(data));
+        }
+        else {
+            return amf_str(NULL);
+        }
    }
case AMF_TYPE_NULL: return NULL;
case AMF_TYPE_UNDEFINED: return NULL;

The patch eliminates the intermediate strdup and passes the original buffer with its authoritative size, closing the length mismatch. See the GitHub commit on flvmeta for full context.

Detection Methods for CVE-2026-82820

Indicators of Compromise

Unexpected crashes or segmentation faults in flvmeta processes when parsing user-supplied FLV files.
Heap corruption warnings surfaced by glibc (for example, malloc(): corrupted top size) associated with FLVMeta invocations.
Presence of FLVMeta binaries at version 1.2.2 or earlier without the f412a33b9a84c2d1a9dee145a868feddbf64879e patch applied.

Detection Strategies

Inventory build systems, transcoding servers, and developer workstations for FLVMeta binaries and compare against the patched commit hash.
Run vulnerable builds under AddressSanitizer (ASan) against the public proof-of-concept to confirm exposure.
Monitor upload directories and CI pipelines for FLV files with anomalous AMF metadata sizes.

Monitoring Recommendations

Log all flvmeta process exits and alert on non-zero exit codes or SIGSEGV terminations.
Track file provenance for FLV inputs processed by automated media pipelines and quarantine unverified sources.
Watch package repositories for updated FLVMeta releases that incorporate the upstream fix.

How to Mitigate CVE-2026-82820

Immediate Actions Required

Rebuild FLVMeta from source at or after commit f412a33b9a84c2d1a9dee145a868feddbf64879e, or apply the diff directly to src/amf.c and src/amf.h.
Restrict who can submit FLV files to systems that invoke FLVMeta, and isolate the tool in a sandbox or container with minimal privileges.
Audit downstream consumers of the amf_string_new API for callers that still pass caller-owned duplicated buffers.

Patch Information

The upstream fix is available in the FLVMeta repository as commit f412a33b9a84c2d1a9dee145a868feddbf64879e. The patch changes the amf_string_new prototype to accept a const byte * and removes the strdup-based path that produced the size mismatch. Track the GitHub Issue #27 discussion for release status, and consult the VulDB CVE-2026-82820 entry for additional metadata.

Workarounds

Avoid processing untrusted FLV files with FLVMeta until the patch is applied.
Wrap FLVMeta invocations in a resource-limited sandbox (for example, bwrap, firejail, or a container) to contain the impact of heap corruption.
Enable hardened memory allocators or compile with -fsanitize=address during testing to surface exploitation attempts.

bash

# Rebuild FLVMeta from a patched source tree
git clone https://github.com/noirotm/flvmeta.git
cd flvmeta
git checkout f412a33b9a84c2d1a9dee145a868feddbf64879e
cmake -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build
sudo cmake --install build

# Verify the installed binary version
flvmeta --version