AIKIDO-2025-10407
webmproject.libvpx is vulnerable to Integer Overflow
59
Medium Risk
This Affects:
webmproject.libvpxTL;DR
Affected versions of this package are vulnerable to integer overflow. Calling vpx_img_alloc() with large values for the d_w, d_h, or align parameters can cause overflows in buffer size and offset calculations, leading to invalid fields in the returned vpx_image_t struct. Similarly, calling vpx_img_wrap() with large values for the d_w, d_h, or stride_align parameters can result in similar overflows and invalid struct fields.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
webmproject.libvpx is vulnerable to Integer Overflow in versions 1.0.0 - 1.14.0.
How to fix this
Upgrade the webmproject.libvpx library to the patch version.
Links
github.com/webmproject/libvpx/blob/main/CHANGELOG
g-issues.chromium.org/issues/332382766lists.debian.org/debian-lts-announce/2024/06/msg00005.html
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.