Skip to content

Product

debian/libvpx vulnerabilities

42 published CVES affecting debian/libvpx, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
42
Critical
2
High
12
Medium
13
Low
0
Unscored
15
CISA KEV
1

Latest debian/libvpx CVEs

Newest publication first · page 1 of 2

  3. CVE-2026-2447 Heap buffer overflow in libvpx

    Published
    HighCVSS 7.5 EPSS 0.69%

    Heap buffer overflow in libvpx. This vulnerability was fixed in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2.

  9. CVE-2024-5197 Integer overflow in libvpx

    Published
    MediumCVSS 5.9 EPSS 0.81%

    There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct...

  10. CVE-2023-6349 Heap overflow in libvpx

    Published
    MediumCVSS 5.7 EPSS 0.37%

    A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above

  17. CVE-2020-0034 In vp8_decode_frame of decodeframe.c, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure if error correction were turned on, with...

    Published
    HighCVSS 7.5 EPSS 1.9%

    In vp8_decode_frame of decodeframe.c, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure if error correction were turned on, with no additional execution privileges needed. User interaction is not needed for e...

  21. CVE-2019-9433 In libvpx, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interactio...

    Published
    MediumCVSS 6.5 EPSS 3.0%

    In libvpx, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-...

  22. CVE-2019-9371 In libvpx, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is nee...

    Published
    MediumCVSS 6.5 EPSS 3.0%

    In libvpx, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-13278325...

  23. CVE-2019-9325 In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is ne...

    Published
    MediumCVSS 6.5 EPSS 2.6%

    In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-1120013...

  24. CVE-2019-9232 In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is no...

    Published
    HighCVSS 7.5 EPSS 4.9%

    In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-122...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.