CVE-2026-82820— FLVMeta AMF String Processing amf.c amf_string_new heap-based overflow
Quick assessment
Affected
n/a FLVMeta
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 FLVMeta 1.2.2 及更早版本中发现了一个漏洞。受影响的是组件“AMF 字符串处理”中文件 的 函数。对参数 的处理会导致堆缓冲区溢出。该攻击可远程发起。利用该漏洞的利用方式已公开，且可能被使用。用于修复该问题的补丁编号为 。应应用该补丁以修复此问题。项目维护者对该漏洞的安全影响表示怀疑：“虽然我承认这些 bug 并提供了修复，但我尚未看到任何可利用这些所谓漏洞的方式。”
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82820
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FLVMeta AMF String Processing amf.c amf_string_new heap-based overflow
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amf_string_new of the file src/amf.c of the component AMF String Processing. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as f412a33b9a84c2d1a9dee145a868feddbf64879e. A patch should be applied to remediate this issue. The project maintainer doubts the security impact: "While I acknowledged the bugs and provided fixes, I have yet to see any way to exploit these alleged vulnerabilities."
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | FLVMeta | 1.2.0 |
cpe:2.3:a:flvmeta:flvmeta:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-82820
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82820
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-82820 (1)
Proof of Concept for CVE-2026-82820 (1)
Other References for CVE-2026-82820 (3)
-
🔗 CVE-2026-82820 in FLVMeta third-party-advisory
-
-
🔗 CVE-2026-82820 FLVMeta AMF String Processing amf.c amf_string_new heap-based overflow vdb-entry technical-description
Same Patch Batch · n/a · 2026-08-31 · 87 CVEs total
| CVE-2026-82608 | 7.4 HIGH | Kamailio AVP cxdx_avp.c get_4bytes out-of-bounds |
| CVE-2026-82630 | 7.3 HIGH | PowerJob Transport Endpoint TestController.java MuConnectionManager.getOrCreateConnection |
| CVE-2026-82598 | 7.3 HIGH | SeaCMS Template search.php parseIf code injection |
| CVE-2026-82600 | 7.3 HIGH | SeaCMS zyapi.php sql injection |
| CVE-2026-82603 | 5.4 MEDIUM | SeaCMS Comment Cache member.php del_pl path traversal |
| CVE-2026-82599 | 5.4 MEDIUM | SeaCMS Avatar Upload member.php unlink path traversal |
| CVE-2026-82623 | 5.3 MEDIUM | open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange |
| CVE-2026-82602 | 5.3 MEDIUM | SeaCMS ass.php authorization |
| CVE-2026-82805 | 4.3 MEDIUM | Typora Mermaid Rendering cross site scripting |
| CVE-2026-82821 | 4.3 MEDIUM | FLVMeta AMF Object Parsing amf.c amf_object_get null pointer dereference |
| CVE-2026-82601 | 4.3 MEDIUM | SeaCMS err.php cross site scripting |
| CVE-2026-82596 | 3.3 LOW | LatencyUtils PauseDetector LatencyStats.java LatencyStats.recordDetectedPause memory corru |
| CVE-2026-51717 | TOTOLINK T6 4.1.5 未认证访问控制缺陷 | |
| CVE-2026-51715 | TOTO Link T6 4.1.5未授权MAC过滤删除漏洞 | |
| CVE-2026-51716 | TOTOLINK T6 4.1.5端口转发规则未授权删除 | |
| CVE-2026-51713 | TOTOLINK T6 4.1.5 访问控制不当漏洞 | |
| CVE-2026-51714 | TOTOLINK T6 4.1.5 未认证访问控制缺陷 | |
| CVE-2026-51718 | TOTOLINK T6 4.1.5 未认证访问控制缺陷 | |
| CVE-2026-51704 | TOTOLINK T6 4.1.5 未授权访问控制漏洞 | |
| CVE-2026-51720 | TOTOLINK T6 4.1.5未授权访问控制缺陷 |
Showing top 20 of 87 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: n/a
-
CVE-2026-82821
FLVMeta AMF Object Parsing amf.c amf_object_get null pointer -
CVE-2026-82805
Typora Mermaid Rendering cross site scripting -
CVE-2026-82630
PowerJob Transport Endpoint TestController.java MuConnection -
CVE-2026-82623
open62541 History Backend ua_history_data_backend_memory.c U -
CVE-2026-82608
Kamailio AVP cxdx_avp.c get_4bytes out-of-bounds
Same weakness: CWE-122
-
CVE-2026-82591
Open Asset Import Library Assimp MD5Loader.cpp MakeDataUniqu -
CVE-2026-38821
openNDS 11.0.0 前堆缓冲区溢出漏洞 -
CVE-2026-19313
Fireware OS Pre-Authentication Heap Buffer Overflow in iked -
CVE-2026-81851
Fireware OS Heap-Based Buffer Overflow in iked Allows Denial -
CVE-2026-34674
Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122)
V. Comments for CVE-2026-82820
No comments yet