CVE-2020-36130

What it actually does

NULL pointer dereference in the AV1 decoder interface (av1/av1_dx_iface.c) that causes an immediate crash on processing malformed input.

Why it matters to the business

Media-processing applications or services become unavailable when they encounter attacker-supplied AV1 content, resulting in denial-of-service outages and potential user disruption.

How an attack unfolds

An attacker creates a specially malformed AV1 stream and delivers it to a victim application that links against the vulnerable AOM library; when the decoder parses the stream the NULL dereference occurs and the process terminates.

How to fix it

Upgrade the AOM library to a version newer than 2.0.1 that resolves the NULL dereference; rebuild and redeploy all dependent applications with the updated library.

How to confirm the fix worked

Confirm the installed AOM version is newer than 2.0.1; run regression tests with known-malformed AV1 samples to verify the decoder no longer crashes.

Typical attack path

1. Craft AV1 media that triggers the NULL dereference
2. Host or transmit the media to the target application
3. Victim application invokes the AV1 decoder on the stream
4. Decoder dereferences NULL pointer and crashes

How to detect it

Review application crash logs and core dumps for AV1 decoder faults; look for sudden terminations immediately after AV1 stream ingestion in media-processing pipelines.

What your security team should do

• Prioritize patching any internet-facing or high-volume media ingestion services that use AOM
• Add the library to the organization's vulnerability scanning inventory and block builds against version 2.0.1
• Monitor upstream AOM releases for the official fix and schedule library updates within standard change windows