Heap-use-after-free Vulnerability in libavc: Critical Memory Management Flaw
Summary
OSV-2025-534: Heap-use-after-free in ih264_inter_pred_luma_horz_ssse3. Affects libavc versions >= 375b9b7e44b067d7b87bcae7291154ae59c72267, < 6f5a49da5db207a149a3f0cc43fd850502017012. Fixed in 6f5a49da5db207a149a3f0cc43fd850502017012. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libavc is an open-source library developed by Ittiam Systems, primarily used for video encoding and decoding. It provides efficient algorithms for handling various video formats, making it a crucial component in multimedia applications. However, like many complex software systems, it is susceptible to vulnerabilities that can compromise its stability and security.
Vulnerability Detail
The vulnerability identified as OSV-2025-534 is a heap-use-after-free issue that occurs in the function ih264_inter_pred_luma_horz_ssse3. This flaw can lead to a crash during the decoding process, specifically when the library attempts to access memory that has already been freed. The ramifications of this vulnerability include potential application crashes and exploitation by malicious actors to execute arbitrary code, leading to severe security risks.
How To Fix
Minimum fixed version
6f5a49da5db207a149a3f0cc43fd850502017012
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the specific functions that trigger the vulnerability until the package is updated. However, this may limit functionality and is not a permanent solution.
Conclusion
The heap-use-after-free vulnerability in libavc poses significant risks to applications utilizing this library. It is crucial for developers and users to update to the patched version to safeguard against potential exploitation and ensure the stability of their applications.
See every vulnerability recorded for libavc →
FAQ
A heap-use-after-free vulnerability occurs when a program continues to use memory after it has been freed, leading to undefined behavior, crashes, or potential exploitation.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can receive real-time alerts about vulnerabilities.
The consequences include application crashes and the possibility of arbitrary code execution, which can lead to data breaches or system compromise.
Yes, you can temporarily avoid using the affected functions until you can apply the update. However, this is not a long-term solution.
Detailed information can be found in the OSS-Fuzz report at https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=428771938.
References
Related vulnerabilities
Recent vulnerabilities recorded for libavc.
