{"id":"CVE-2024-5171","aliases":["ALPINE-CVE-2024-5171","AZL-62420","BELL-CVE-2024-5171","DEBIAN-CVE-2024-5171","DLA-3881-1","DSA-5753-1","EUVD-2024-46420","GHSA-592c-fmq9-g63c","JLSEC-2026-122","MGASA-2024-0220","OESA-2024-1949","OESA-2026-2776","OESA-2026-2779","SUSE-SU-2024:2030-1","SUSE-SU-2024:2052-1","SUSE-SU-2024:2056-1","UBUNTU-CVE-2024-5171","USN-6815-1","USN-7397-1"],"status":"published","title":"heap buffer overflow in libaom","description":"Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:\n\n\n  *  Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.","severity":{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01264,"percentile":0.69945,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-20"],"published":"2024-06-04T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"aom","fixed_in":["3.9.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"aom","fixed_in":["3.9.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"aom","fixed_in":["3.9.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"aom","fixed_in":["3.9.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"aom","fixed_in":["3.9.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"aom","fixed_in":["3.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"aom","fixed_in":["3.9.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"aom","fixed_in":["3.7.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"aom","fixed_in":["3.9.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"aom","fixed_in":["3.6.0-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"aom","fixed_in":["3.8.2-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"aom","fixed_in":["3.8.2-3"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"aom","fixed_in":["1.0.0.errata1-3+deb11u2"],"sources":["osv"]},{"ecosystem":"Julia","package":"libaom_jll","fixed_in":["3.11.0+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"aom","fixed_in":["3.6.0-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"aom","fixed_in":["3.8.0-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"aom","fixed_in":["1.0.0-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"aom","fixed_in":["1.0.0-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libaom","fixed_in":["1.0.0-150200.3.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"libaom","fixed_in":["1.0.0-150200.3.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libaom","fixed_in":["1.0.0-150200.3.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"libaom","fixed_in":["1.0.0-150200.3.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libaom","fixed_in":["1.0.0-150200.3.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"libaom","fixed_in":["1.0.0-150200.3.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"libaom","fixed_in":["1.0.0-150200.3.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"libaom","fixed_in":["3.2.0-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libaom","fixed_in":["3.2.0-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libaom","fixed_in":["3.2.0-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libaom","fixed_in":["3.2.0-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libaom","fixed_in":["3.2.0-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"libaom","fixed_in":["3.2.0-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"libaom","fixed_in":["3.2.0-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"libaom","fixed_in":["3.2.0-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"libaom","fixed_in":["3.7.1-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"libaom","fixed_in":["3.7.1-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"libaom-devel-doc","fixed_in":["3.7.1-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"aom","fixed_in":["1.0.0.errata1-3+deb11u1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"aom","fixed_in":["3.3.0-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"aom","fixed_in":["3.8.2-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libao","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.0-24"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.9.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.7.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.9.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1+deb12u1"}]}],"versions":["3.6.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-3"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0.errata1-3+deb11u2"}]}],"versions":["1.0.0.errata1-3","1.0.0.errata1-3+deb11u1"]},{"source":"osv","ecosystem":"Debian:12","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1+deb12u1"}]}],"versions":["3.6.0-1"]},{"source":"osv","ecosystem":"Julia","package":"libaom_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.11.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150200.3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libaom-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0.errata1-3+deb11u1ubuntu0.1"}]}],"versions":["1.0.0-3","1.0.0.errata1-2","1.0.0.errata1-2ubuntu3","1.0.0.errata1-3","1.0.0.errata1-3build1","1.0.0.errata1-3+deb11u1build0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-1ubuntu0.1"}]}],"versions":["1.0.0.errata1-3build1","3.2.0-2","3.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-2ubuntu0.1"}]}],"versions":["3.6.1-1","3.7.0-1","3.7.1-1","3.8.1-1","3.8.2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-2ubuntu0.1"}]}],"versions":["3.6.1-1","3.7.0-1","3.7.1-1","3.8.1-1","3.8.2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0.errata1-3+deb11u1ubuntu0.1"}]}],"versions":["1.0.0-3","1.0.0.errata1-2","1.0.0.errata1-2ubuntu3","1.0.0.errata1-3","1.0.0.errata1-3build1","1.0.0.errata1-3+deb11u1build0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-1ubuntu0.1"}]}],"versions":["1.0.0.errata1-3build1","3.2.0-2","3.3.0-1"]}],"products":[{"vendor":"aomedia","product":"libaom"},{"vendor":"libaom","product":"libaom"}],"references":[{"url":"https://issues.chromium.org/issues/332382766","tags":["x_transferred","Exploit","evidence","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5NRNCEYS246CYGOR32MF7OGKWOWER22/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00024.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5171","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5NRNCEYS246CYGOR32MF7OGKWOWER22"},{"url":"https://github.com/advisories/GHSA-592c-fmq9-g63c"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-5171","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-5171","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-5171","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0220.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33280","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6815-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/security-bulletins/detail?id=openEuler-SA-2024-1949","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2776","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2779","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242030-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1226020","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-5171","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242052-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242056-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-5171","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-5171","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7397-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-5171","title":"heap buffer overflow in libaom","description":"Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:\n\n\n  *  Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.","status":"published","published":"2024-06-05T19:11:12.987Z","modified":"2025-02-13T17:53:49.724Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:01.286506Z"}],"euvd":[{"id":"EUVD-2024-46420","description":"Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:\n\n\n  *  Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.","status":"published","published":"2024-06-05T19:11:12Z","modified":"2025-02-13T17:53:49Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T20:53:31.305109Z"}],"ghsa":[{"id":"GHSA-592c-fmq9-g63c","title":"Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow....","description":"Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:\n\n\n  *  Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.","status":"published","published":"2024-06-05T21:31:29Z","modified":"2024-08-02T05:05:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"cwes":["CWE-20","CWE-190"],"updated_at":"2026-11-02T14:57:50.552665Z"}],"nvd":[{"id":"CVE-2024-5171","description":"Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:\n\n\n  *  Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.","status":"published","published":"2024-06-05T20:15:13.8Z","modified":"2026-06-17T08:15:20.57Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-20","CWE-190"],"updated_at":"2026-11-02T14:10:03.465199Z"}],"osv":[{"id":"ALPINE-CVE-2024-5171","description":"Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:\n\n\n  *  Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.","status":"published","published":"2024-06-05T20:15:13.8Z","modified":"2026-11-02T11:17:50.125016004Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-62420","title":"CVE-2024-5171 affecting package libao 1.2.0-24","description":"Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:\n\n\n  *  Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.","status":"published","published":"2024-06-05T20:15:13Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"BELL-CVE-2024-5171","status":"published","published":"2024-06-07T05:57:44.1321Z","modified":"2026-09-06T07:15:11.372815069Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:20.963569Z"},{"id":"CVE-2024-5171","description":"Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:\n\n\n  *  Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.","status":"published","published":"2024-06-05T20:15:13.8Z","modified":"2026-04-16T04:31:50.135876832Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:44.032344Z"},{"id":"DEBIAN-CVE-2024-5171","description":"Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:     *  Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.   *  Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.   *  Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.","status":"published","published":"2024-06-05T20:15:13.8Z","modified":"2026-11-02T12:03:07.537841656Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:44.117337Z"},{"id":"JLSEC-2026-122","description":"Integer overflow in libaom internal function `img_alloc_helper` can lead to heap buffer overflow. This function can be reached via 3 callers:\n\n  - Calling `aom_img_alloc()` with a large value of the `d_w`, `d_h`, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned `aom_image_t` struct may be invalid.\n  - Calling `aom_img_wrap()` with a large value of the `d_w`, `d_h`, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned `aom_image_t` struct may be invalid.\n  - Calling `aom_img_alloc_with_border()` with a large value of the `d_w`, `d_h`, align, `size_align`, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned `aom_image_t` struct may be invalid.","status":"published","published":"2026-04-16T23:30:44.982Z","modified":"2026-07-25T18:23:53.945735374Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2024-1949","title":"aom security update","description":"The Alliance for Open Media’s focus is to deliver a next-generation video format that is:\r\n\r\nSecurity Fix(es):\r\n\r\nInteger overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:\r\n\r\n\n  *  Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.(CVE-2024-5171)","status":"published","published":"2024-08-02T11:07:25Z","modified":"2026-08-18T01:18:32.397752992Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2026-2776","title":"aom security update","description":"The Alliance for Open Media’s focus is to deliver a next-generation video format that is:\r\n\r\nSecurity Fix(es):\n\nInteger overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:\n\n\n  *  Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.(CVE-2024-5171)","status":"published","published":"2026-06-24T11:11:42Z","modified":"2026-08-18T01:21:11.160152565Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2779","title":"aom security update","description":"The Alliance for Open Media’s focus is to deliver a next-generation video format that is:\r\n\r\nSecurity Fix(es):\n\nInteger overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:\n\n\n  *  Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.\n  *  Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.(CVE-2024-5171)","status":"published","published":"2026-06-24T11:11:42Z","modified":"2026-08-18T01:21:11.171311992Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"UBUNTU-CVE-2024-5171","description":"Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:   *  Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.   *  Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.   *  Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.","status":"published","published":"2024-06-04T00:00:00Z","modified":"2026-04-22T15:18:48.852555Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T16:55:11.182485Z"},{"id":"DLA-3881-1","title":"aom - security update","status":"published","published":"2024-09-07T00:00:00Z","modified":"2026-03-09T01:19:24.251762Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5753-1","title":"aom - security update","status":"published","published":"2024-08-21T00:00:00Z","modified":"2026-03-09T02:09:03.930621Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0220","title":"Updated aom packages fix security vulnerability","description":"Integer overflow in libaom internal function img_alloc_helper can lead\nto heap buffer overflow. This function can be reached via 3 callers: *\nCalling aom_img_alloc() with a large value of the d_w, d_h, or align\nparameter may result in integer overflows in the calculations of buffer\nsizes and offsets and some fields of the returned aom_image_t struct may\nbe invalid. * Calling aom_img_wrap() with a large value of the d_w, d_h,\nor align parameter may result in integer overflows in the calculations\nof buffer sizes and offsets and some fields of the returned aom_image_t\nstruct may be invalid. * Calling aom_img_alloc_with_border() with a\nlarge value of the d_w, d_h, align, size_align, or border parameter may\nresult in integer overflows in the calculations of buffer sizes and\noffsets and some fields of the returned aom_image_t struct may be\ninvalid. (CVE-2024-5171)\n","status":"published","published":"2024-06-14T17:30:25Z","modified":"2026-04-16T04:41:23.536568217Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"SUSE-SU-2024:2030-1","title":"Security update for libaom","description":"This update for libaom fixes the following issues:\n\n- CVE-2024-5171: Fixed heap buffer overflow in img_alloc_helper() caused by integer overflow (bsc#1226020).\n","status":"published","published":"2024-06-14T06:09:28Z","modified":"2026-02-04T04:11:27.656967Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:2052-1","title":"Security update for libaom","description":"This update for libaom fixes the following issues:\n\n- CVE-2024-5171: Fixed heap buffer overflow in img_alloc_helper() caused by integer overflow (bsc#1226020).\n","status":"published","published":"2024-06-18T08:34:57Z","modified":"2026-02-04T03:08:43.036257Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:2056-1","title":"Security update for libaom","description":"This update for libaom fixes the following issues:\n\n- CVE-2024-5171: Fixed heap buffer overflow in img_alloc_helper() caused by integer overflow (bsc#1226020).\n","status":"published","published":"2024-06-18T11:06:41Z","modified":"2026-02-04T04:38:45.691157Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-6815-1","title":"aom vulnerability","description":"Xiantong Hou discovered that AOM did not properly handle certain malformed\nmedia files. If an application using AOM opened a specially crafted file, a\nremote attacker could cause a denial of service, or possibly execute\narbitrary code.\n","status":"published","published":"2024-06-06T18:12:41Z","modified":"2026-04-22T10:47:24.373259Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-7397-1","title":"aom vulnerability","description":"Xiantong Hou discovered that AOM did not properly handle certain malformed\nmedia files. If an application using AOM opened a specially crafted file, a\nremote attacker could cause a denial of service, or possibly execute\narbitrary code.\n","status":"published","published":"2025-03-31T13:08:50Z","modified":"2026-04-22T10:56:56.673016Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}