CVE-2025-48175

Summary (CVE-2025-48175) In libavif prior to 1.3.0, the function avifImageRGBToYUV in reformat.c contains integer overflows during multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes. This is documented across multiple vendor advisories (e.g., Debian, SUSE) updating to 1.3....

CVE-2020-36407

CVE-2020-36407 affects libavif 0.8.0 and 0.8.1, where an out-of-bounds write occurs in avifDecoderDataFillImageGrid. The issue is described as a memory corruption vulnerability in the decoder path. CVSS data in the initial description cites a base score of 8.8 (HIGH, CVSS 3.1) with NETWORK attack...

CVE-2025-48174

In libavif offset+size (CVE-2025-48174). This is the primary CVE described; related advisories (e.g., SUSE security updates and Debian security advisory) indicate upgrading to libavif 1.3.0 or later mitigates the issue. Affected products include various Linux distributions; patches explicitly fix...