CVE-2018-20198 is a NULL pointer dereference vulnerability in Freeware Advanced Audio Decoder 2 (FAAD2) version 2.8.8, specifically within the ifilter_bank function of libfaad/filtbank.c. This flaw can lead to a denial of service due to an application crash caused by a segmentation fault when handling windowed output in the LONG_START_SEQUENCE case. Rated 5.5 MEDIUM, the vulnerability requires local access and user interaction (e.g., opening a malicious audio file) to trigger, with the primary impact being high availability loss. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.8.8CPE matchmatch criteria | cpe:2.3:a:audiocoding:freeware_advanced_audio_decoder_2:2.8.8:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.