fdkaac before 1.0.5 was discovered to contain a heap buffer overflow in caf_info function in caf_reader.c.