PT-2026-35334
Published
2026-04-16
·
Updated
2026-04-16
Description by
CVSS 3.1
9.8
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Integer overflow in libaom internal function
img alloc helper can lead to heap buffer overflow. This function can be reached via 3 callers:- Calling
aom img alloc()with a large value of thed w,d h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returnedaom image tstruct may be invalid. - Calling
aom img wrap()with a large value of thed w,d h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returnedaom image tstruct may be invalid. - Calling
aom img alloc with border()with a large value of thed w,d h, align,size align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returnedaom image tstruct may be invalid.
Exploitability
Fix
Vendors
Affected products
Related identifiers
Found an issue in the description? Have something to add? Feel free to write us 👾