CVE-2023-6349

What it actually does

Heap overflow in libvpx VP9 encoder when processing a frame whose dimensions exceed the originally configured size, allowing out-of-bounds writes in memory.

Why it matters to the business

Applications that encode VP9 video with libvpx face risk of crashes, denial of service, or potential arbitrary code execution when handling oversized frames, which can disrupt video pipelines and require emergency patching across dependent systems.

How an attack unfolds

An attacker supplies a VP9 frame larger than the encoder context was initialized for; the encoder allocates based on the original size but writes data based on the larger frame, overflowing the heap buffer. Exploitation requires local access and specific encoding conditions, with no public exploits or threat actor campaigns observed.

How to fix it

Upgrade webmproject/libvpx to version 1.13.1 or later, specifically applying commit 10b9492dcf05b652e2e4b370e205bd605d421972. Rebuild and redeploy all dependent applications after the upgrade.

How to confirm the fix worked

Verify the installed libvpx version or commit hash matches or exceeds the fixed version; test encoding operations with oversized frames to confirm no overflow occurs.

Typical attack path

1. Identify a target application that uses libvpx for VP9 encoding
2. Craft or supply a video frame whose dimensions exceed the encoder's configured size
3. Trigger the encoding operation on the oversized frame
4. Trigger heap overflow leading to memory corruption or crash

How to detect it

Review application and system logs for crashes or segmentation faults during VP9 encoding operations with libvpx; inspect process memory dumps or core files for heap corruption patterns around video frame handling.

What your security team should do

• Immediately inventory all systems and libraries using libvpx and schedule upgrades to the fixed version
• Prioritize patching in any video encoding or streaming services
• Monitor for application crashes during VP9 encoding as a potential indicator of attempted exploitation