Every CVE Search/ Get API key

CVE-2023-6349

Heap overflow in libvpx

5.7 MediumFix available

A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
Passive

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
None

Exploit likelihood

0.36%Up 0.3 points since May 28, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.7

Heap overflow in libvpx

A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above

Record
CVE-2023-6349
CVSS 4.0
5.7 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/S:N/AU:N/R:A/V:D
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2023-58590 5.7

A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above

Record
EUVD-2023-58590
CVSS 4.0
5.7 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/S:N/AU:N/R:A/V:D
Updated
2026-11-03
NVD 5.7

A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above

Record
CVE-2023-6349
CVSS 4.0
5.7 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:D/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-122, CWE-787
Updated
2026-11-02
OSV 5.7

Heap overflow in libvpx

A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above

Record
CVE-2023-6349
CVSS 4.0
5.7 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/S:N/AU:N/R:A/V:D
Weakness
CWE-122
Updated
2026-11-02
OSVDEBIAN-CVE-2023-6349 7.5

A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above

Record
DEBIAN-CVE-2023-6349
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVJLSEC-2026-376 5.7

A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above

Record
JLSEC-2026-376
CVSS 4.0
5.7 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:D/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVRHSA-2024:5941 7.1

Red Hat Security Advisory: libvpx security update

Record
RHSA-2024:5941
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2024:5941 7.1

Moderate: libvpx security update

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.

Security Fix(es):

  • libvpx: Heap buffer overflow related to VP9 encoding (CVE-2023-6349)

  • libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2024:5941
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-6349 5.7

A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above

Record
UBUNTU-CVE-2023-6349
CVSS 4.0
5.7 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/S:N/AU:N/R:A/V:D
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2024:5941 No score

Moderate: libvpx security update

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.

Security Fix(es):

  • libvpx: Heap buffer overflow related to VP9 encoding (CVE-2023-6349)
  • libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:5941
Updated
2026-11-02
OSVSUSE-SU-2024:2408-1 No score

Security update for libvpx

This update for libvpx fixes the following issues:

  • CVE-2024-5197: Fixed interger overflow when calling vpx_img_alloc() or vpx_img_wrap() with large parameters (bsc#1225879).
  • CVE-2023-6349: Fixed heap overflow when encoding a frame that has larger dimensions than the originally configured size (bsc#1225403).
Record
SUSE-SU-2024:2408-1
Updated
2026-11-02
OSVSUSE-SU-2024:2409-1 No score

Security update for libvpx

This update for libvpx fixes the following issues:

  • CVE-2024-5197: Fixed interger overflow when calling vpx_img_alloc() or vpx_img_wrap() with large parameters (bsc#1225879).
  • CVE-2023-6349: Fixed heap overflow when encoding a frame that has larger dimensions than the originally configured size (bsc#1225403).
  • CVE-2023-44488: Fixed heap buffer overflow in vp8 encoding (bsc#1216879).
Record
SUSE-SU-2024:2409-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libvpx
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.7.0-11.el8_10
1.7.0-11.el8_10
libvpx-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.7.0-11.el8_10
1.7.0-11.el8_10
libvpx
Debian:12
 before 1.12.0-1+deb12u2, plus listed versions
1.12.0-11.12.0-1+deb12u1
1.12.0-1+deb12u2
libvpx
Debian:13
 before 1.13.1-2
1.13.1-2
libvpx
Debian:14
 before 1.13.1-2
1.13.1-2
LibVPX_jll
Julia
 before 1.15.2+0
1.15.2+0
libvpx
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.7.0-11.el8_10
0:1.7.0-11.el8_10
libvpx-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.7.0-11.el8_10
0:1.7.0-11.el8_10
libvpx-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.7.0-11.el8_10
0:1.7.0-11.el8_10
libvpx-utils-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.7.0-11.el8_10
0:1.7.0-11.el8_10
Show 35 moreShow less
Affected packages
PackageAffectedFixed
libvpx-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:1.7.0-11.el8_10
0:1.7.0-11.el8_10
libvpx-debugsource
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:1.7.0-11.el8_10
0:1.7.0-11.el8_10
libvpx-devel
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:1.7.0-11.el8_10
0:1.7.0-11.el8_10
libvpx-utils-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 2 CVEs
 before 0:1.7.0-11.el8_10
0:1.7.0-11.el8_10
libvpx
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.7.0-11.el8_10
0:1.7.0-11.el8_10
libvpx
SUSE:Linux Enterprise Module for Desktop Applications 15 SP5
From an advisory covering 2 CVEs
 before 1.6.1-150000.6.16.1
1.6.1-150000.6.16.1
libvpx
SUSE:Linux Enterprise Module for Desktop Applications 15 SP6
From an advisory covering 2 CVEs
 before 1.6.1-150000.6.16.1
1.6.1-150000.6.16.1
libvpx
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 2 CVEs
 before 1.6.1-150000.6.16.1
1.6.1-150000.6.16.1
libvpx
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 2 CVEs
 before 1.6.1-150000.6.16.1
1.6.1-150000.6.16.1
libvpx
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 2 CVEs
 before 1.6.1-150000.6.16.1
1.6.1-150000.6.16.1
libvpx
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 1.6.1-150000.6.16.1
1.6.1-150000.6.16.1
libvpx
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 2 CVEs
 before 1.6.1-150000.6.16.1
1.6.1-150000.6.16.1
libvpx
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 2 CVEs
 before 1.6.1-150000.6.16.1
1.6.1-150000.6.16.1
libvpx
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 1.6.1-150000.6.16.1
1.6.1-150000.6.16.1
libvpx
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 2 CVEs
 before 1.6.1-150000.6.16.1
1.6.1-150000.6.16.1
libvpx
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 2 CVEs
 before 1.6.1-150000.6.16.1
1.6.1-150000.6.16.1
libvpx
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 2 CVEs
 before 1.6.1-150000.6.16.1
1.6.1-150000.6.16.1
libvpx
SUSE:Enterprise Storage 7.1
From an advisory covering 2 CVEs
 before 1.6.1-150000.6.16.1
1.6.1-150000.6.16.1
libvpx
SUSE:Linux Enterprise Module for Basesystem 15 SP5
From an advisory covering 3 CVEs
 before 1.11.0-150400.3.7.1
1.11.0-150400.3.7.1
libvpx
SUSE:Linux Enterprise Module for Basesystem 15 SP6
From an advisory covering 3 CVEs
 before 1.11.0-150400.3.7.1
1.11.0-150400.3.7.1
libvpx
SUSE:Linux Enterprise Module for Package Hub 15 SP5
From an advisory covering 3 CVEs
 before 1.11.0-150400.3.7.1
1.11.0-150400.3.7.1
libvpx
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 3 CVEs
 before 1.11.0-150400.3.7.1
1.11.0-150400.3.7.1
libvpx
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 3 CVEs
 before 1.11.0-150400.3.7.1
1.11.0-150400.3.7.1
libvpx
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 3 CVEs
 before 1.11.0-150400.3.7.1
1.11.0-150400.3.7.1
libvpx
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 3 CVEs
 before 1.11.0-150400.3.7.1
1.11.0-150400.3.7.1
libvpx
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 3 CVEs
 before 1.11.0-150400.3.7.1
1.11.0-150400.3.7.1
libvpx
SUSE:Manager Proxy 4.3
From an advisory covering 3 CVEs
 before 1.11.0-150400.3.7.1
1.11.0-150400.3.7.1
libvpx
SUSE:Manager Server 4.3
From an advisory covering 3 CVEs
 before 1.11.0-150400.3.7.1
1.11.0-150400.3.7.1
libvpx
openSUSE:Leap 15.5
From an advisory covering 3 CVEs
 before 1.11.0-150400.3.7.1
1.11.0-150400.3.7.1
libvpx
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 1.11.0-150400.3.7.1
1.11.0-150400.3.7.1
libvpx
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.2.0-21.3.0-11.3.0-21.3.0-2ubuntu0.1~esm11.3.0-2ubuntu0.1~esm21.3.0-2ubuntu0.1~esm31.3.0-2ubuntu0.1+esm3
 None known
libvpx
Ubuntu:Pro:16.04:LTS
 before 1.5.0-2ubuntu1.1+esm2, plus listed versions
1.4.0-41.5.0-21.5.0-2ubuntu11.5.0-2ubuntu1.11.5.0-2ubuntu1.1+esm1
1.5.0-2ubuntu1.1+esm2
libvpx
Ubuntu:Pro:18.04:LTS
 before 1.7.0-3ubuntu0.18.04.1+esm1, plus listed versions
1.6.1-31.7.0-31.7.0-3ubuntu0.18.04.1
1.7.0-3ubuntu0.18.04.1+esm1
libvpx
Ubuntu:20.04:LTS
 before 1.8.2-1ubuntu0.2, plus listed versions
1.8.1-21.8.2-11.8.2-1build1
1.8.2-1ubuntu0.2
libvpx
Ubuntu:22.04:LTS
 before 1.11.0-2ubuntu2.2, plus listed versions
1.9.0-1ubuntu11.11.0-2ubuntu11.11.0-2ubuntu2
1.11.0-2ubuntu2.2

History

History
RecordedChangedSources
affected, facts
aliases, products, publishedEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-6349 is a medium vulnerability (CVSS 5.7) in Chromium Libvpx, published May 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in libvpx 1.12.0-1+deb12u2.

References

Show 26 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open