Priority LOW 29
In libavif before 1.3.0, avifImageRGBToYUV in reformat.c has integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00338 · Published 2025-05-16 · Fixed in 1.3.0 CWE-190
Priority LOW 39
In libavif before 1.3.0, makeRoom in stream.c has an integer overflow and resultant buffer overflow in stream->offset+size.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00375 · Published 2025-05-16 · Fixed in 1.3.0 CWE-190
Priority HIGH 82
Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow.
CVSS 4.0CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.01264 · Published 2024-06-05 · Partial fix · 3.9.0 CWE-20
Priority MEDIUM 44
Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc().
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01175 · Published 2023-12-27 · Fixed in 3.7.1 CWE-20
Priority MEDIUM 40
AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00738 · Published 2023-08-29 · No fix listed CWE-119
Priority LOW 32
AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01485 · Published 2021-12-02 · No fix listed CWE-476
Priority LOW 31
AOM v2.0.1 was discovered to contain a segmentation violation via the component aom_dsp/x86/obmc_sad_avx2.c.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01192 · Published 2021-12-02 · No fix listed CWE-125
Priority MEDIUM 42
AOM v2.0.1 was discovered to contain a global buffer overflow via the component av1/encoder/partition_search.h.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01772 · Published 2021-12-02 · No fix listed CWE-120
Priority MEDIUM 42
AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01772 · Published 2021-12-02 · No fix listed CWE-787
Priority LOW 32
AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01485 · Published 2021-12-02 · No fix listed CWE-476
Priority MEDIUM 41
AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01474 · Published 2021-12-02 · No fix listed CWE-787
Priority MEDIUM 41
libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01413 · Published 2021-07-01 · No fix listed CWE-787
Priority MEDIUM 46
aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02216 · Published 2021-06-04 · No fix listed CWE-120
Priority MEDIUM 46
aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01885 · Published 2021-06-02 · No fix listed CWE-416
Priority MEDIUM 46
aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0205 · Published 2021-05-06 · No fix listed CWE-763
THREATIST.IORead the docs