Heap Buffer Overflow in libvpx: Critical Vulnerability Detected
Summary
OSV-2026-97: Heap-buffer-overflow in vpx_wb_write_literal. Affects libvpx versions >= f72b9f6a85fdc4fbbec6402146fb653130330e8f, < d5f35ac8d93cba7f7a3f7ddb8f9dc8bd28f785e1. Fixed in d5f35ac8d93cba7f7a3f7ddb8f9dc8bd28f785e1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libvpx is an open-source video codec library that is widely used for encoding and decoding video streams in various formats, particularly in WebM and VP9. It is known for its efficiency and performance in handling video data. However, like many software libraries, it is susceptible to vulnerabilities that can lead to severe security issues, including memory corruption and crashes.
Vulnerability Detail
The vulnerability identified is a heap buffer overflow occurring in the function vpx_wb_write_literal. This issue was reported through OSS-Fuzz, a service that finds security vulnerabilities in open-source software. The crash state indicates that the overflow can lead to unauthorized memory access, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The vulnerability was introduced in commit f72b9f6a85fdc4fbbec6402146fb653130330e8f and has been fixed in commit d5f35ac8d93cba7f7a3f7ddb8f9dc8bd28f785e1.
How To Fix
Minimum fixed version
d5f35ac8d93cba7f7a3f7ddb8f9dc8bd28f785e1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users may consider disabling the specific functionality that triggers the vulnerability until the package can be updated. However, this is not a permanent solution and should be addressed as soon as possible.
Conclusion
The heap buffer overflow vulnerability in libvpx poses significant risks to applications utilizing this library. It is crucial to update to the patched version to mitigate these risks. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your software.
See every vulnerability recorded for libvpx →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, which can lead to memory corruption and potential exploitation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
The consequences can include unauthorized access to system memory, execution of arbitrary code, and denial of service, which can compromise the integrity and availability of your application.
Yes, you should upgrade to the version that includes the fix for this vulnerability, specifically after commit d5f35ac8d93cba7f7a3f7ddb8f9dc8bd28f785e1.
If an immediate update is not possible, consider disabling the affected functionality as a temporary workaround until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for libvpx.
