CVE-2017-9220: The mp4ff_read_stco function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 all...

Security readout for executives and security teams

CVE-2017-9220 is a denial-of-service flaw in FAAD2 2.7. A crafted MP4 file can trigger a memory allocation error in the decoder, potentially crashing media handling workflows that process untrusted files. The public data does not provide a CVSS score or confirmed patch version. Exposure is most likely where FAAD2 2.7 is directly deployed or bundled into applications that decode uploaded, emailed, downloaded, or otherwise untrusted MP4 media. The supplied affected-product metadata is incomplete. Prioritize if the organization processes untrusted MP4 files at scale or in customer-facing workflows. Otherwise, handle through dependency hygiene because public severity and exploitation evidence are limited. Mitigation focus: Inventory applications and containers for FAAD2 2.7 usage.; Check FAAD2 or downstream vendor guidance for fixed versions.; Reduce exposure of services decoding untrusted MP4 files..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.