{"id":"CVE-2023-39616","aliases":["DEBIAN-CVE-2023-39616","EUVD-2023-43325","GHSA-8gm5-9276-cvrc","ROOT-OS-DEBIAN-12-CVE-2023-39616","UBUNTU-CVE-2023-39616"],"status":"published","title":"AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the...","description":"AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00738,"percentile":0.54975,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2023-08-29T00:00:00Z","modified":"2026-10-26T18:02:31Z","fixes":[{"ecosystem":"Debian:13","package":"aom","fixed_in":["3.7.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"aom","fixed_in":["3.7.0-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"aom","fixed_in":["3.6.0-1+deb12u3.aikido.15"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-aom","fixed_in":["3.6.0-1+deb12u3.aikido.15"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.0-1","3.11.0-1","3.11.0~rc1-1","3.12.0-1","3.12.0-1~exp1","3.12.0~rc1-1~exp1","3.12.1-1","3.12.1~rc1-1~exp1","3.13.1-1","3.13.1-1~exp1","3.13.1-2","3.14.1-1","3.6.0-1","3.6.0-1+deb12u1","3.6.0-1+deb12u2","3.6.0-1+deb12u3","3.6.1-1","3.7.0-1","3.7.0-1~exp1","3.7.0~rc3-1","3.7.0~really3.6.1-1","3.7.1-1","3.8.1-1","3.8.2-1","3.8.2-2","3.8.2-3","3.9.1-1","3.9.1-1~exp1"]},{"source":"osv","ecosystem":"Debian:13","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0-1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1+deb12u3.aikido.15"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1+deb12u3.aikido.15"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.1+dfsg-4","5.9.1+dfsg-4ubuntu1","5.9.2+dfsg-2ubuntu1","5.9.3+dfsg-0ubuntu1","5.9.4+dfsg-0ubuntu1","5.9.5+dfsg-0ubuntu2","5.9.5+dfsg-0ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.12.4+dfsg-1ubuntu1","5.12.4+dfsg-1ubuntu3","5.12.5+dfsg-3ubuntu1","5.12.5+dfsg-6ubuntu2","5.12.5+dfsg-7","5.12.5+dfsg-7build1","5.12.8+dfsg-0ubuntu1","5.12.8+dfsg-0ubuntu1.1","5.12.8+dfsg-0ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qt6-webengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.2+dfsg-6ubuntu2","6.2.4+dfsg-1ubuntu1","6.2.4+dfsg-1ubuntu2","6.2.4+dfsg-6ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.6+dfsg-1","5.15.6+dfsg-2","5.15.7+dfsg-2","5.15.8+dfsg-1","5.15.8+dfsg-1build1","5.15.8+dfsg-1build2","5.15.8+dfsg-2","5.15.9+dfsg-1","5.15.9+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qt6-webengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.2-final+dfsg-11","6.4.2-final+dfsg-12","6.4.2-final+dfsg-12build1","6.4.2-final+dfsg-12ubuntu1","6.4.2-final+dfsg-12ubuntu7","6.4.2-final+dfsg-12ubuntu9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-2","5.15.15+dfsg-2build2","5.15.15+dfsg-2ubuntu1","5.15.16+dfsg-1","5.15.16+dfsg-1ubuntu2","5.15.16+dfsg-1ubuntu4","5.15.16+dfsg-3","5.15.16+dfsg-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qt6-webengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.3+dfsg-0ubuntu1","6.8.3+dfsg-0ubuntu2","6.9.2+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.18+dfsg-2","5.15.18+dfsg-2build1","5.15.19+dfsg-1","5.15.19+dfsg2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qt6-webengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.2+dfsg-1","6.10.2+dfsg-4","6.10.2+dfsg-5","6.11.2+dfsg-3ubuntu1","6.11.2+dfsg-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.19+dfsg2-4","5.15.19+dfsg2-6","5.15.19+dfsg2-7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qt6-webengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.9.2+dfsg-2","6.9.2+dfsg-4","6.9.2+dfsg-4build1","6.9.2+dfsg-4build2","6.10.2+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.19+dfsg2-1","5.15.19+dfsg2-1build1","5.15.19+dfsg2-2","5.15.19+dfsg2-3","5.15.19+dfsg2-4","5.15.19+dfsg2-4ubuntu0.1~esm1"]}],"products":[{"vendor":"aomedia","product":"aomedia"}],"references":[{"url":"https://bugs.chromium.org/p/aomedia/issues/detail?id=3372#c3","tags":["x_transferred","Issue Tracking","Patch","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39616"},{"url":"https://github.com/advisories/GHSA-8gm5-9276-cvrc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-39616","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-39616","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39616","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-39616","description":"AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.","status":"published","published":"2023-08-29T00:00:00Z","modified":"2024-10-02T13:25:00.253Z","updated_at":"2026-11-02T14:35:33.138994Z"}],"euvd":[{"id":"EUVD-2023-43325","description":"AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.","status":"published","published":"2023-08-29T00:00:00Z","modified":"2024-10-02T13:25:00Z","updated_at":"2026-11-03T00:27:59.473662Z"}],"ghsa":[{"id":"GHSA-8gm5-9276-cvrc","title":"AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the...","description":"AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.","status":"published","published":"2023-08-29T18:31:53Z","modified":"2024-04-04T07:15:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:56:49.876332Z"}],"nvd":[{"id":"CVE-2023-39616","description":"AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.","status":"published","published":"2023-08-29T17:15:12.633Z","modified":"2026-06-17T06:12:37.533Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:08:25.025396Z"}],"osv":[{"id":"CVE-2023-39616","description":"AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.","status":"published","published":"2023-08-29T17:15:12.633Z","modified":"2026-03-14T12:12:50.980594Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"DEBIAN-CVE-2023-39616","description":"AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.","status":"published","published":"2023-08-29T17:15:12.633Z","modified":"2026-10-26T18:02:31.832549051Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2023-39616","title":"CVE-2023-39616 in aom - Patched by Root","description":"Root has patched CVE-2023-39616 in the aom package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-14T12:03:20Z","modified":"2026-09-14T13:15:05.240844911Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"UBUNTU-CVE-2023-39616","description":"AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_common_int.h.","status":"published","published":"2023-08-29T17:15:00Z","modified":"2026-10-17T12:56:25.069354902Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:22.741943Z"}]}}