CVE-2018-20199

MEDIUM 5.5CVE-2018-20199 · Published 18/12/2018 · updated 17/06/2026

In short

CVE-2018-20199 is a MEDIUM (CVSS 5.5) vulnerability affecting freeware advanced audio decoder 2 (audiocoding).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.4% of all vulnerabilities.
Fix: update to 2.9.0 or later.

Package	Affected versions	Patched versions
freeware advanced audio decoder 2 audiocoding	`< 2.9.0`	`2.9.0`

Description

A NULL pointer dereference was discovered in ifilter_bank of libfaad/filtbank.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The vulnerability causes a segmentation fault and application crash, which leads to denial of service because adding to windowed output is mishandled in the ONLY_LONG_SEQUENCE case.

References

knik0/faad2 · Exploit
lists.debian.org/debian-lts-announce/2019/08/msg00033.html · Mailing List
lists.debian.org/debian-lts-announce/2021/10/msg00020.html · Mailing List
security.gentoo.org/glsa/202006-17 · Third Party Advisory
debian.org/security/2022/dsa-5109 · Third Party Advisory

More vulnerabilities in freeware advanced audio decoder 2

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

freeware advanced audio decoder 2

audiocoding

< 2.9.0

2.9.0

Description

More vulnerabilities in freeware advanced audio decoder 2

See all →