Critical Security Update for libavif: Addressing Vulnerabilities CVE-2025-48174 and CVE-2025-48175
Summary
DSA-5930-1: libavif - security update. Affects libavif versions < 0.11.1-1+deb12u1. Fixed in 0.11.1-1+deb12u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libavif is a library designed for encoding and decoding AVIF (AV1 Image File Format) images. It provides efficient image compression and supports advanced features such as HDR and alpha transparency. However, vulnerabilities in this library can lead to security risks, potentially allowing attackers to exploit weaknesses in image processing.
Vulnerability Detail
The vulnerabilities identified as CVE-2025-48174 and CVE-2025-48175 in libavif stem from improper handling of certain image files, which could lead to memory corruption or denial of service. These vulnerabilities may allow attackers to craft malicious AVIF images that, when processed by vulnerable applications, could execute arbitrary code or crash the application, posing significant risks to system integrity and user data.
How To Fix
Minimum fixed version
0.11.1-1+deb12u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libavifTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid processing untrusted AVIF images until the update is applied. Additionally, implementing strict input validation for image files can help mitigate the risk of exploitation.
Conclusion
The vulnerabilities CVE-2025-48174 and CVE-2025-48175 in libavif pose significant security risks that can be mitigated by updating to the latest patched version. Users are encouraged to take immediate action to protect their systems and data.
See every vulnerability recorded for libavif →
FAQ
These are identifiers for specific vulnerabilities found in the libavif library that could lead to memory corruption or denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
Failing to update could leave your system vulnerable to attacks that exploit these vulnerabilities, potentially leading to data loss or unauthorized access.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If you experience problems after updating, consider reverting to the previous version and report the issue to the maintainers of libavif for further assistance.
Related vulnerabilities
Recent vulnerabilities recorded for libavif.
