Skip to content
OpenAdvisories
Medium USN-7249-1 1 CVE

libvpx vulnerability

Published Feb 3, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

Xiantong Hou discovered that libvpx would overflow when attempting to
allocate memory for very large images. If an application using libvpx
opened a specially crafted file, a remote attacker could possibly use
this issue to cause the application to crash, resulting in a denial
of service, or the execution of arbitrary code.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS libvpx 1.3.0-2ubuntu0.1+esm3
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS libvpx 1.5.0-2ubuntu1.1+esm3
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS libvpx 1.7.0-3ubuntu0.18.04.1+esm2

Vulnerabilities 1

  • Medium 5.9
    CVE-2024-5197

    Integer overflow in libvpx

    There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the return…

    Chromium libvpx libvpx libvpx Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2024-5197