CVE-2025-48174

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-48174
In libavif before 1.3.0, makeRoom in stream.c has an integer overflow and resultant buffer overflow in stream->offset+size.

9.1 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/AOMediaCodec/libavif/commit/50a743062938a3828581d725facc9c2b92a1d109 Patch
https://github.com/AOMediaCodec/libavif/commit/c9f1bea437f21cb78f9919c332922a3b0ba65e11 Patch
https://github.com/AOMediaCodec/libavif/commit/e5fdefe7d1776e6c4cf1703c163a8c0535599029 Patch
https://github.com/AOMediaCodec/libavif/pull/2768 Issue Tracking Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:aomedia:libavif:*:*:*:*:*:*:*:*
History

04 Jun 2025, 20:02

Type Values Removed Values Added
First Time Aomedia
Aomedia libavif
CPE cpe:2.3:a:aomedia:libavif:*:*:*:*:*:*:*:*
References () https://github.com/AOMediaCodec/libavif/commit/50a743062938a3828581d725facc9c2b92a1d109 - () https://github.com/AOMediaCodec/libavif/commit/50a743062938a3828581d725facc9c2b92a1d109 - Patch
References () https://github.com/AOMediaCodec/libavif/commit/c9f1bea437f21cb78f9919c332922a3b0ba65e11 - () https://github.com/AOMediaCodec/libavif/commit/c9f1bea437f21cb78f9919c332922a3b0ba65e11 - Patch
References () https://github.com/AOMediaCodec/libavif/pull/2768 - () https://github.com/AOMediaCodec/libavif/pull/2768 - Issue Tracking, Patch
References () https://github.com/AOMediaCodec/libavif/commit/e5fdefe7d1776e6c4cf1703c163a8c0535599029 - () https://github.com/AOMediaCodec/libavif/commit/e5fdefe7d1776e6c4cf1703c163a8c0535599029 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.1
CWE CWE-190

16 May 2025, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-16 05:15

Updated : 2025-06-04 20:02

NVD link : CVE-2025-48174

Mitre link : CVE-2025-48174

JSON object : View

Products Affected

aomedia

  • libavif
CWE
CWE-190

Integer Overflow or Wraparound