CVE-2020-22056: 
Ffmpeg vulnerability analysis and mitigation

A Denial of Service vulnerability was identified in FFmpeg version 4.2, specifically in the configinput function within the afacrossover.c file. The vulnerability was assigned CVE-2020-22056 and was publicly disclosed on June 2, 2021. The issue affects FFmpeg multimedia framework version 4.2 (NVD, Ubuntu).

The vulnerability is characterized by a memory leak in the configinput function of afacrossover.c. According to the technical analysis, the issue results in approximately 19,584 bytes of memory being definitely lost during execution. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The weakness has been classified as CWE-401: Missing Release of Memory after Effective Lifetime (NVD).

The vulnerability can lead to a Denial of Service condition through memory leaks, potentially affecting system availability. When exploited, the vulnerability causes the application to fail to properly release allocated memory after its effective lifetime, leading to resource exhaustion (NVD).

The vulnerability has been fixed in subsequent releases of FFmpeg. A patch was implemented and is available through the upstream repository. The fix can be found in the FFmpeg git repository through commit daf2bef98ded7f8431fd04bf3324669329a923c1 (Debian Tracker).