There exists a NULL pointer dereference in ffvc1parseframeheader_adv in vc1.c in Libav 12.3, which allows attackers to cause a denial-of-service through a crafted aac file.