CVE-2026-82821: FLVMeta Use-After-Free Vulnerability

CVE-2026-82821 Overview

CVE-2026-82821 is a null pointer dereference vulnerability in FLVMeta versions up to 1.2.2. The flaw resides in the amf_object_get function within src/amf.c, part of the Action Message Format (AMF) object parsing component. Processing a malformed AMF object triggers dereferencing of a null pointer, causing the process to crash. The issue is tracked under CWE-404: Improper Resource Shutdown or Release. A public proof-of-concept exists, though the project maintainer has stated they are not aware of any working exploitation path beyond a segmentation fault.

Critical Impact
Remote attackers can crash the FLVMeta process by supplying a crafted FLV file with a malformed AMF object, resulting in a denial-of-service condition against tooling or automation pipelines that call FLVMeta.

Affected Products

FLVMeta versions up to and including 1.2.2
The amf_object_get function in src/amf.c
AMF Object Parsing component

Discovery Timeline

2026-08-31 - CVE-2026-82821 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82821

Vulnerability Analysis

FLVMeta is a command-line utility for manipulating metadata in Flash Video (FLV) files. During AMF object parsing, the amf_object_get function traverses a linked list of name-data node pairs to locate a requested key. The pre-patch implementation advanced the iterator by two nodes in a single step (node = node->next->next) without validating the intermediate node. When the linked list is malformed and terminates on a name node without an accompanying data node, node->next returns NULL, and dereferencing NULL->next triggers a segmentation fault.

The fault occurs entirely within the parser and does not, based on available evidence, permit control of the instruction pointer or memory contents. The maintainer explicitly questioned any security impact beyond a crash, and no known exploit chain converts this into code execution.

Root Cause

The root cause is missing null-check validation during linked-list traversal of AMF object elements. The parser assumed a well-formed structure where every name node is followed by a data node. Attacker-supplied FLV content violates this invariant.

Attack Vector

An attacker delivers a crafted FLV file to a system that invokes FLVMeta, for example an upload pipeline, a media transcoding service, or a batch processing job. User interaction is required to process the file. Successful triggering crashes the process. There is no available exploitation path to code execution or information disclosure documented in the referenced sources.

// Patch: src/amf.c - amf_object_get null-check on traversal
                 return (node != NULL) ? node->data : NULL;
             }
             /* we have to skip the element data to reach the next name */
-            node = node->next->next;
+            node = node->next;
+            /* the data node is NULL, which is invalid, so we assume we reached the end */
+            if (node == NULL) {
+                return NULL;
+            }
+            node = node->next;
         }
     }
     return NULL;

Source: GitHub Commit 52642f7. The fix splits the double-advance into two single-step advances with an intermediate null check, safely terminating iteration when the list is malformed.

Detection Methods for CVE-2026-82821

Indicators of Compromise

FLVMeta process termination with SIGSEGV when parsing untrusted FLV files
Core dumps containing a null pointer dereference inside amf_object_get at src/amf.c
Repeated crashes of media processing workers after ingesting attacker-supplied FLV content

Detection Strategies

Monitor for abnormal exit codes and segmentation faults from FLVMeta invocations in batch or upload workflows
Inspect FLV files for malformed AMF object structures prior to invoking FLVMeta
Track version metadata across build systems and container images to identify FLVMeta binaries at or below 1.2.2

Monitoring Recommendations

Enable structured logging for wrapper scripts calling FLVMeta so unexpected termination is captured
Aggregate crash telemetry from media processing hosts into a central log platform for anomaly review
Alert when the same source or upload account causes repeated FLVMeta crashes within a short window

How to Mitigate CVE-2026-82821

Immediate Actions Required

Apply upstream commit 52642f7dfb76ec7334016622dde60b1ae963d79b to any FLVMeta build derived from 1.2.2 or earlier
Rebuild and redeploy container images and packages that bundle FLVMeta
Restrict FLVMeta execution to sandboxed workers that can be restarted on crash without impacting the parent service

Patch Information

The fix is available as upstream commit 52642f7dfb76ec7334016622dde60b1ae963d79b in the FLVMeta repository. The related discussion is tracked in GitHub Issue #28. Additional details are available at VulDB CVE-2026-82821.

Workarounds

Validate FLV files with a schema-aware pre-parser before handing them to FLVMeta
Run FLVMeta under a supervisor that isolates crashes and does not propagate failures to the calling service
Reject FLV uploads from untrusted sources until the patched build is deployed

bash

# Build FLVMeta from patched source
git clone https://github.com/noirotm/flvmeta.git
cd flvmeta
git checkout 52642f7dfb76ec7334016622dde60b1ae963d79b
cmake -B build -S .
cmake --build build
./build/flvmeta --version