ECHO-b0ae-facc-5ae1
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-b0ae-facc-5ae1.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-b0ae-facc-5ae1
- Upstream
- Withdrawn
- 2026-10-04T13:45:03Z
- Published
- 2026-06-01T07:30:03Z
- Modified
- 2026-10-04T14:15:06Z
- Summary
- The CVE text claims arbitrary code execution "via creating a crafted AAC file" in libx264. libx264 is an H.264 encoder and never parses AAC or any other container or audio input. The only reference, x264 issue #75, is a LeakSanitizer report from running FFmpeg's configure checks with --enable-libx264: when x264_encoder_open() fails, its fail: path frees the encoder without x264_param_cleanup(), so the copied parameter strings (a few hundred bytes) leak once. There is no out-of-bounds access, no use-after-free and no attacker-controlled data involved. FFmpeg closed the original ticket as invalid and pointed at the leak in libx264. The record was assigned by MITRE with no CNA score; the 9.8 comes from CISA-ADP. Debian rates it unimportant in every suite ("Negligible security impact, usually only used for short-lived processes"), and no x264 commit since the report touches this path, so there is nothing to backport.
- Details
- References