This vulnerability in FFmpeg 3.2's Firequalizer filter (libavfilter/af_firequalizer.c) is due to a missing validation of the av_malloc_array() return value in the config_input() function. If av_malloc_array() returns NULL and this is not checked, a NULL pointer dereference occurs, leading to application crash. An attacker can trigger this by supplying a crafted media file that is processed with the Firequalizer filter enabled, causing denial of service. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability.

Successful exploitation causes a denial of service by crashing the application processing the crafted media file with the Firequalizer filter enabled. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The provided Red Hat advisory link does not specify an available patch or workaround. Users should monitor official vendor channels for updates and avoid processing untrusted media files with the Firequalizer filter enabled until a fix is confirmed.