{"id":"CVE-2017-8906","aliases":["EUVD-2017-17846","GHSA-9g24-5f9c-j34j","UBUNTU-CVE-2017-8906"],"status":"published","title":"An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for...","description":"An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.4, as used by the x265_encoder_encode dependency in libbpg and other products. A small picture can cause an integer underflow, which leads to a Denial of Service in the process of encoding.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00795,"percentile":0.56676,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-191"],"published":"2017-05-11T20:00:00Z","modified":"2026-06-17T01:27:10Z","affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"x265","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7-4","1.8-4","1.8-5","1.8-6","1.9-3","1.9-3ubuntu0.1~esm1"]}],"products":[{"vendor":"multicorewareinc","product":"x265_high_efficiency_video_coding"}],"references":[{"url":"https://bitbucket.org/multicoreware/x265/issues/345/integer-underflow-in-x265-source-common","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8906"},{"url":"https://github.com/advisories/GHSA-9g24-5f9c-j34j"},{"url":"https://ubuntu.com/security/CVE-2017-8906","tags":["report"]},{"url":"https://bitbucket.org/multicoreware/x265_git/issues/345/integer-underflow-in-x265-source-common","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-8906","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-8906","description":"An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.4, as used by the x265_encoder_encode dependency in libbpg and other products. A small picture can cause an integer underflow, which leads to a Denial of Service in the process of encoding.","status":"published","published":"2017-05-11T20:00:00Z","modified":"2024-09-16T23:52:03.715Z","updated_at":"2026-11-02T14:33:14.89365Z"}],"euvd":[{"id":"EUVD-2017-17846","description":"An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.4, as used by the x265_encoder_encode dependency in libbpg and other products. A small picture can cause an integer underflow, which leads to a Denial of Service in the process of encoding.","status":"published","published":"2017-05-11T20:00:00Z","modified":"2024-09-16T23:52:03Z","updated_at":"2026-11-03T00:29:04.415682Z"}],"ghsa":[{"id":"GHSA-9g24-5f9c-j34j","title":"An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for...","description":"An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.4, as used by the x265_encoder_encode dependency in libbpg and other products. A small picture can cause an integer underflow, which leads to a Denial of Service in the process of encoding.","status":"published","published":"2022-05-13T01:17:42Z","modified":"2023-02-01T05:05:11Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T14:50:13.694184Z"}],"nvd":[{"id":"CVE-2017-8906","description":"An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.4, as used by the x265_encoder_encode dependency in libbpg and other products. A small picture can cause an integer underflow, which leads to a Denial of Service in the process of encoding.","status":"published","published":"2017-05-11T20:29:00.163Z","modified":"2026-06-17T01:27:10.733Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T14:03:47.848196Z"}],"osv":[{"id":"UBUNTU-CVE-2017-8906","description":"An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.4, as used by the x265_encoder_encode dependency in libbpg and other products. A small picture can cause an integer underflow, which leads to a Denial of Service in the process of encoding.","status":"published","published":"2017-05-11T20:29:00Z","modified":"2026-04-22T11:34:58.276868Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:16.154988Z"}]}}