There exists a heap-based buffer overflow in vc1_decode_i_block_adv in vc1_block.c in Libav 12.3, which allows attackers to cause a denial-of-service via a crafted aac file. https://nvd.nist.gov/vuln/detail/CVE-2018-18828
