CVE-2024-5197

What it actually does

Integer overflows in vpx_img_alloc() and vpx_img_wrap() when supplied large d_w, d_h, align or stride_align values cause incorrect buffer size/offset calculations and leave fields of the returned vpx_image_t struct invalid, enabling subsequent memory corruption.

Why it matters to the business

Applications that decode or encode VP8/VP9/WebM video streams may crash or allow arbitrary memory writes, leading to service outages or remote code execution in media pipelines and browsers.

How an attack unfolds

An attacker supplies a malicious image descriptor containing oversized width, height or alignment values to vpx_img_alloc or vpx_img_wrap; the resulting integer overflow produces an undersized or misaligned buffer that later write operations corrupt adjacent memory.

How to fix it

Upgrade webmproject/libvpx to commit 12f3a2ac603e8f10742105519e0cd03c3b8f71dd (version 1.14.1) or newer in all dependent builds; rebuild and redeploy any statically linked binaries or containers.

How to confirm the fix worked

Confirm the installed libvpx shared object or source tree reports version 1.14.1 or later; fuzz allocation paths with maximum-size d_w/d_h parameters and verify no invalid vpx_image_t fields are produced.

Typical attack path

1. Identify a target process that links against a vulnerable libvpx version and accepts attacker-controlled video parameters
2. Craft a VPX image allocation call or incoming bitstream that triggers vpx_img_alloc/vpx_img_wrap with large d_w/d_h/align values
3. Trigger subsequent library operations that dereference the corrupted vpx_image_t fields to achieve memory corruption
4. Leverage the corruption primitive for code execution or denial of service

How to detect it

Review process creation logs and library load events for unexpected invocations of vpx_img_alloc or vpx_img_wrap; inspect crash dumps for invalid image descriptor values; correlate with inbound video streams containing anomalous dimension fields.

What your security team should do

• Inventory all products and containers that statically or dynamically link libvpx and schedule upgrades within 30 days
• Add libvpx version checks to build pipelines and dependency scanners
• Monitor EPSS and KEV feeds for any future rise in exploit maturity