Null Pointer Dereference in FLVMeta AMF Object Parsing
CVE-2026-82821

5.3MEDIUM

Key Information:

Vendor: FLVMeta
Status: Flvmeta
Vendor: CVE Published:; 31 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-82821?

A vulnerability exists in FLVMeta, affecting versions up to 1.2.2, specifically within the AMF Object Parsing component. This deficiency enables an attacker to exploit the function amf_object_get located in the src/amf.c file, causing a null pointer dereference. Although the attack can be initiated remotely, the maintainer has expressed skepticism regarding the security implications of this vulnerability, stating a lack of evidence for any real-world exploitation despite acknowledging the bugs and providing necessary patches. It is highly recommended to apply the patch (commit ID: 52642f7dfb76ec7334016622dde60b1ae963d79b) to mitigate potential risks.

Affected Version(s)

FLVMeta 1.2.0

FLVMeta 1.2.1

FLVMeta 1.2.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-82821 - Proof of Concept