OSV-2021-1237
Heap-buffer-overflow in ih264d_parse_decode_slice
No scoreFix available
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38482
Crash type: Heap-buffer-overflow READ 4
Crash state:
ih264d_parse_decode_slice
ih264d_parse_nal_unit
ih264d_video_decode
What each source reports
OSV No score
Heap-buffer-overflow in ih264d_parse_decode_slice
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38482
Crash type: Heap-buffer-overflow READ 4
Crash state:
ih264d_parse_decode_slice
ih264d_parse_nal_unit
ih264d_video_decode
- Record
OSV-2021-1237- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libavcOSS-Fuzz |
Listed versions, plus commit ranges android-10.0.0_r12android-10.0.0_r13android-10.0.0_r14android-10.0.0_r7android-10.0.0_r8 Show 45 moreShow lessandroid-10.0.0_r9android-11.0.0_r1android-11.0.0_r16android-11.0.0_r17android-11.0.0_r18android-11.0.0_r19android-11.0.0_r2android-11.0.0_r20android-11.0.0_r21android-11.0.0_r22android-11.0.0_r23android-11.0.0_r24android-11.0.0_r25android-11.0.0_r26android-11.0.0_r27android-11.0.0_r28android-11.0.0_r29android-11.0.0_r3android-11.0.0_r32android-11.0.0_r33android-11.0.0_r34android-11.0.0_r35android-11.0.0_r36android-11.0.0_r37android-11.0.0_r4android-11.0.0_r43android-11.0.0_r44android-11.0.0_r45android-11.0.0_r46android-11.0.0_r47android-11.0.0_r48android-11.0.0_r5android-12.0.0_r1android-12.0.0_r10android-12.0.0_r11android-12.0.0_r12android-12.0.0_r13android-12.0.0_r14android-12.0.0_r15android-12.0.0_r16android-12.0.0_r2android-12.0.0_r3android-12.0.0_r4android-12.0.0_r5android-12.0.0_r6 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
OSV-2021-1237 is a vulnerability with no CVSS score yet in libavc, published September 12, 2021. No source lists public exploit code. A source reports a fix.
References
This page doesn't list everything
Left out here: 358 versions. The JSON record has them.