{"result":"OK","data":{"documents":{"CVE-2024-5171":{"id":"CVE-2024-5171","vendorId":null,"type":"cve","bulletinFamily":"cve","title":"CVE-2024-5171","description":"Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:\n\n\n  *  Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.","attachments":[],"timestamps":{"created":"2024-06-05T17:15:13Z","updated":"2026-08-24T16:26:19.349000Z","enriched":"2026-08-18T05:51:09.515000Z","reviewed":"2026-08-26T09:58:34.126000Z","metricsUpdated":"2026-06-16T02:34:34.769000Z","contentUpdated":"2026-08-24T16:26:19.349000Z"},"published":"2024-06-05T19:11:12","modified":"2026-06-17T08:15:20","epss":[{"cve":"CVE-2024-5171","epss":0.01254,"percentile":0.67371,"date":"2026-09-01"}],"cvss":{"score":10.0,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H","source":"cve-coordination@google.com"},"metrics":{"nvd":{"cvss31":{"source":"nvd","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"cna":{"cvss4":{"source":"cve-coordination@google.com","version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnerableSystemImpactConfidentiality":"HIGH","subsequentSystemImpactConfidentiality":"HIGH","vulnerableSystemImpactIntegrity":"HIGH","subsequentSystemImpactIntegrity":"HIGH","vulnerableSystemImpactAvailability":"HIGH","subsequentSystemImpactAvailability":"HIGH"}},"adp":{"ssvc":{"id":"CVE-2024-5171","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2024-06-07T17:15:17.406236Z"}}},"cvss2":{},"cvss3":{"cvssV31":{"source":"nvd","version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},"cvss4":{"cvssV4":{"source":"cve-coordination@google.com","version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnerableSystemImpactConfidentiality":"HIGH","subsequentSystemImpactConfidentiality":"HIGH","vulnerableSystemImpactIntegrity":"HIGH","subsequentSystemImpactIntegrity":"HIGH","vulnerableSystemImpactAvailability":"HIGH","subsequentSystemImpactAvailability":"HIGH"}},"href":"https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-5171","sourceAvailable":true,"reporter":"Google","references":["https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5NRNCEYS246CYGOR32MF7OGKWOWER22/","https://issues.chromium.org/issues/332382766","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP/","https://lists.debian.org/debian-lts-announce/2024/09/msg00024.html"],"cvelist":["CVE-2024-5171"],"immutableFields":[],"lastseen":"2026-08-24T16:26:19","viewCount":389,"enchantments":{"dependencies":{"references":[{"type":"alpinelinux","idList":["ALPINE:CVE-2024-5171"]},{"type":"astralinux","idList":["ASTRA:3899261127223575834732077078083"]},{"type":"bdu_fstec","idList":["BDU:2024-04523"]},{"type":"circl","idList":["CIRCL:CVE-2024-5171"]},{"type":"cnnvd","idList":["CNNVD-202406-408"]},{"type":"cvelist","idList":["CVELIST:CVE-2024-5171"]},{"type":"debian","idList":["DEBIAN:DLA-3881-1:4129B","DEBIAN:DSA-5753-1:CB0F2"]},{"type":"debiancve","idList":["DEBIANCVE:CVE-2024-5171"]},{"type":"euvd","idList":["EUVD-2024-46420"]},{"type":"fedora","idList":["FEDORA:24B912016B98","FEDORA:82B6720109EF"]},{"type":"hp","idList":["HPSBHF04027"]},{"type":"mageia","idList":["MGASA-2024-0220"]},{"type":"nessus","idList":["DEBIAN_DLA-3881.NASL","DEBIAN_DSA-5753.NASL","FEDORA_2024-D2B54D5A9D.NASL","FEDORA_2024-DD14EEFB0E.NASL","NEWSTART_CGSL_NS-SA-2025-0109_FIREFOX.NASL","SUSE_SU-2024-2030-1.NASL","SUSE_SU-2024-2056-1.NASL","TENCENTOS_TSSA_2024_0525.NASL","TENCENTOS_TSSA_2024_0714.NASL","UBUNTU_USN-6815-1.NASL","UBUNTU_USN-7397-1.NASL","UNPATCHED_CVE_2024_5171.NASL"]},{"type":"nvd","idList":["NVD:CVE-2024-5171"]},{"type":"openvas","idList":["OPENVAS:1361412562310856236","OPENVAS:1361412562310856349","OPENVAS:1361412562310887249","OPENVAS:1361412562310887255","OPENVAS:13614125623111020240220","OPENVAS:13614125623111120245753","OPENVAS:13614125623111220243881","OPENVAS:136141256231112202468151","OPENVAS:136141256231112202573971","OPENVAS:13614125623114202420301","OPENVAS:13614125623114202420521"]},{"type":"osv","idList":["OSV:ALPINE-CVE-2024-5171","OSV:AZL-62420","OSV:BELL-CVE-2024-5171","OSV:DEBIAN-CVE-2024-5171","OSV:DLA-3881-1","OSV:DSA-5753-1","OSV:JLSEC-2026-122","OSV:MGASA-2024-0220","OSV:OESA-2024-1949","OSV:OESA-2026-2776","OSV:OESA-2026-2779","OSV:SUSE-SU-2024:2030-1","OSV:SUSE-SU-2024:2052-1","OSV:SUSE-SU-2024:2056-1","OSV:UBUNTU-CVE-2024-5171","OSV:USN-6815-1","OSV:USN-7397-1"]},{"type":"ptsecurity","idList":["PT-2024-4075"]},{"type":"redhatcve","idList":["RH:CVE-2024-5171"]},{"type":"redos","idList":["ROS-20240619-11","ROS-20240627-01"]},{"type":"susecve","idList":["SUSECVE:CVE-2024-5171"]},{"type":"ubuntu","idList":["USN-6815-1","USN-7397-1"]},{"type":"ubuntucve","idList":["UB:CVE-2024-5171"]},{"type":"veracode","idList":["VERACODE:47391"]},{"type":"vulnrichment","idList":["VULNRICHMENT:CVE-2024-5171"]}]},"score":{"value":9.6,"uncertanity":0.2,"vector":"NONE"},"short_description":"CVE-2024-5171 Integer Overflow in libaom Internal Functio","tags":["cve-2024-5171","integer overflow","libaom","buffer overflow","nvd"],"twitter":{"counter":2,"tweets":[{"link":"https://twitter.com/akaclandestine/status/1799388834595234264","text":"/hashtag/exploit?src=hashtag_click\n1. CVE-2024-4577:\nMake PHP-CGI Argument Injection\nhttps://t.co/9VO6X057rw\n]-> https://t.co/nkHqtklv5g\n\n2. CVE-2024-5171:\nlibaom Video Codec Library Vulnerability\nhttps://t.co/6Lkg7Vx7gH","author":"akaclandestine","author_photo":"https://pbs.twimg.com/profile_images/1800678598694555648/QMUn70Ag_400x400.jpg"}]},"vulnersScore":9.6},"aiDescription":"CVE-2024-5171: Integer overflow in libaom’s internal function img_alloc_helper can cause a heap buffer overflow when large d_w/d_h/align values are used. The overflow can affect the returned aom_image_t fields via calls to aom_img_alloc(), aom_img_wrap(), or aom_img_alloc_with_border(), as described in multiple advisories. Debian security advisories explicitly state the flaw could potentially allow execution of arbitrary code on malformed media input, with fixed packages in newer releases (e.g., Debian 11 bookworm: 3.6.0-1+deb12u1; DSA-5753-1 for bookworm; DLA-3881-1 for bullseye). Mageia also released a fix, and Fedora/other distributions issued updates. A Proof-of-Concept may exist per advisory metadata. Remediation: upgrade libaom to the patched versions cited in the connected documents and apply the vendor advisories for your distro. Monitor for updates from security trackers and vendors.","cpe":["cpe:/a:aomedia:libaom::::"],"cpe23":["cpe:2.3:a:aomedia:libaom:*:*:*:*:*:*:*:*"],"cwe":["CWE-190","CWE-20"],"vulnStatus":"Modified","affectedSoftware":[{"cpeName":"aomedia:libaom","version":"3.9.0","operator":"le","name":"aomedia libaom"}],"affectedConfiguration":[],"cpeConfiguration":{},"cpeConfigurations":{"nvdCpeConfiguration":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"versionStartIncluding":"1.0.0","versionEndIncluding":"3.9.0","criteria":"cpe:2.3:a:aomedia:libaom:*:*:*:*:*:*:*:*"}]}]}],"_index":true},"extraReferences":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5NRNCEYS246CYGOR32MF7OGKWOWER22/"},{"url":"https://issues.chromium.org/issues/332382766"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP/"},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00024.html"}],"cnaAffected":[{"defaultStatus":"unaffected","product":"libaom","repo":"https://aomedia.googlesource.com/aom/","vendor":"libaom","versions":[{"lessThan":"3.9.0","status":"affected","version":"1.0.0","versionType":"custom"}]}],"cnaCpeApplicability":[],"solutions":[],"workarounds":[],"impacts":[{"capecId":"CAPEC-100","descriptions":[{"lang":"en","value":"CAPEC-100 Overflow Buffers"}]}],"exploits":[{"id":"CVE-2024-5171","href":"https://issues.chromium.org/issues/332382766","type":"nvd"}],"problemTypes":[],"assigned":"2024-05-21T12:53:59","origin":"composite","threatData":{},"webApplicability":{"applicable":null,"vulnerabilities":[]}}}}}