CVE-2017-9255: The mp4ff_read_stsc function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 all...

Security readout for executives and security teams

FAAD2 2.7 contains a denial-of-service flaw in MP4 parsing. A specially crafted MP4 file can make the decoder consume excessive CPU, potentially slowing or blocking media-processing services that handle untrusted files. Exposure is most likely where FAAD2 2.7 is embedded in applications, services, appliances, or pipelines that parse MP4 files from users, partners, email, web uploads, or shared storage. Prioritize systems where MP4 processing is internet-facing, customer-facing, or business-critical. The main business risk is service disruption rather than confirmed compromise. Mitigation focus: Identify and upgrade or remove FAAD2 2.7 where vendor guidance confirms a fixed path.; Avoid processing untrusted MP4 files with affected components until guidance is confirmed.; Constrain media-processing workloads with CPU limits, timeouts, and queue isolation..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.