AIKIDO-2025-10407

TL;DR

Affected versions of this package are vulnerable to integer overflow. Calling vpx_img_alloc() with large values for the d_w, d_h, or align parameters can cause overflows in buffer size and offset calculations, leading to invalid fields in the returned vpx_image_t struct. Similarly, calling vpx_img_wrap() with large values for the d_w, d_h, or stride_align parameters can result in similar overflows and invalid struct fields.