CVE catalog
CVE-2024-5197
libvpx vulnerability
- Severity
- High · CVSS 7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.81% · Oct 25, 2026
A flaw was found in libvpx. When creating images, libvpx trusts the width, height, and alignment of the user input. However, it does not properly validate the provided values. This flaw allows an attacker to craft user inputs or trick the user into opening crafted files, where these types of values are invalid, leading to integer overflows during memory allocation procedures. A successful full attack leads to the targeted application crashing, resulting in a denial of service or memory corruption, which results in data integrity issues. libvpx: Integer overflow in vpx_img_alloc() The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | libvpx | sid | 1.17.0-1 | fixed |
| Debian | libvpx | forky | 1.17.0-1 | fixed |
| Debian | libvpx | trixie | 1.15.0-2.1+deb13u1 | fixed |
| Debian | libvpx | trixie-security | 1.15.0-2.1+deb13u1 | fixed |
| Debian | libvpx | bookworm | 1.12.0-1+deb12u5 | fixed |
| Debian | libvpx | bookworm-security | 1.12.0-1+deb12u5 | fixed |
| Ubuntu | libvpx | noble | 1.12.0-1+deb12u3 | fixed |
| Ubuntu | libvpx | noble | 1.14.0-1ubuntu2.1 | fixed |
| Ubuntu | libvpx-dev | noble | 1.14.0-1ubuntu2.1 | fixed |
| Ubuntu | libvpx-doc | noble | 1.14.0-1ubuntu2.1 | fixed |
| Ubuntu | libvpx9 | noble | 1.14.0-1ubuntu2.1 | fixed |
| Ubuntu | vpx-tools | noble | 1.14.0-1ubuntu2.1 | fixed |
| Ubuntu | libvpx | pro | 1.6.1-3 | vulnerable |
| Ubuntu | libvpx | pro | 1.7.0-3 | vulnerable |
| Ubuntu | libvpx | pro | 1.7.0-3ubuntu0.18.04.1 | vulnerable |
| Ubuntu | libvpx | pro | 1.7.0-3ubuntu0.18.04.1+esm1 | vulnerable |
| Ubuntu | libvpx | pro | 1.7.0-3ubuntu0.18.04.1+esm2 | fixed |
| Ubuntu | libvpx | pro | 1.6.1-3 | vulnerable |
| Ubuntu | libvpx | pro | 1.7.0-3 | vulnerable |
| Ubuntu | libvpx | pro | 1.7.0-3ubuntu0.18.04.1 | vulnerable |
| Ubuntu | libvpx | pro | 1.7.0-3ubuntu0.18.04.1+esm1 | vulnerable |
| Ubuntu | libvpx | pro | 1.7.0-3ubuntu0.18.04.1+esm2 | fixed |
| Ubuntu | libvpx | 20.04 | 1.8.1-2 | vulnerable |
| Ubuntu | libvpx | 20.04 | 1.8.2-1 | vulnerable |
| Ubuntu | libvpx | 20.04 | 1.8.2-1build1 | vulnerable |
| Ubuntu | libvpx | 20.04 | 1.8.2-1ubuntu0.2 | vulnerable |
| Ubuntu | libvpx | 20.04 | 1.8.2-1ubuntu0.3 | fixed |
| Ubuntu | libvpx | 22.04 | 1.9.0-1ubuntu1 | vulnerable |
| Ubuntu | libvpx | 22.04 | 1.11.0-2ubuntu1 | vulnerable |
| Ubuntu | libvpx | 22.04 | 1.11.0-2ubuntu2 | vulnerable |
| Ubuntu | libvpx | 22.04 | 1.11.0-2ubuntu2.2 | vulnerable |
| Ubuntu | libvpx | 22.04 | 1.11.0-2ubuntu2.3 | fixed |
| Ubuntu | libvpx | 24.04 | 1.12.0-1ubuntu2 | vulnerable |
| Ubuntu | libvpx | 24.04 | 1.13.1-2ubuntu1 | vulnerable |
| Ubuntu | libvpx | 24.04 | 1.14.0-1ubuntu1 | vulnerable |
| Ubuntu | libvpx | 24.04 | 1.14.0-1ubuntu2 | vulnerable |
| Ubuntu | libvpx | 24.04 | 1.14.0-1ubuntu2.1 | fixed |
| Ubuntu | libvpx | 20.04 | 1.8.1-2 | vulnerable |
| Ubuntu | libvpx | 20.04 | 1.8.2-1 | vulnerable |
| Ubuntu | libvpx | 20.04 | 1.8.2-1build1 | vulnerable |
| Ubuntu | libvpx | 20.04 | 1.8.2-1ubuntu0.2 | vulnerable |
| Ubuntu | libvpx | 20.04 | 1.8.2-1ubuntu0.3 | fixed |
| Ubuntu | libvpx | 22.04 | 1.9.0-1ubuntu1 | vulnerable |
| Ubuntu | libvpx | 22.04 | 1.11.0-2ubuntu1 | vulnerable |
| Ubuntu | libvpx | 22.04 | 1.11.0-2ubuntu2 | vulnerable |
| Ubuntu | libvpx | 22.04 | 1.11.0-2ubuntu2.2 | vulnerable |
| Ubuntu | libvpx | 22.04 | 1.11.0-2ubuntu2.3 | fixed |
| Ubuntu | libvpx | 24.04 | 1.12.0-1ubuntu2 | vulnerable |
| Ubuntu | libvpx | 24.04 | 1.13.1-2ubuntu1 | vulnerable |
| Ubuntu | libvpx | 24.04 | 1.14.0-1ubuntu1 | vulnerable |
| Ubuntu | libvpx | 24.04 | 1.14.0-1ubuntu2 | vulnerable |
| Ubuntu | libvpx | 24.04 | 1.14.0-1ubuntu2.1 | fixed |
| Opensuse | libvpx | tumbleweed | 1.14.1-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | libvpx | source | sid | 1.14.1-1 | not yet assigned | Not reported | Not reported |
| Debian | libvpx | source | forky | 1.14.1-1 | not yet assigned | Not reported | Not reported |
| Debian | libvpx | source | trixie | 1.14.1-1 | not yet assigned | Not reported | Not reported |
| Debian | libvpx | source | bookworm | 1.12.0-1+deb12u3 | not yet assigned | Not reported | Not reported |
| Ubuntu | libvpx | deb | noble | 1.12.0-1+deb12u3 | Not reported | Not reported | Not reported |
| Ubuntu | libvpx | deb | noble | 1.14.0-1ubuntu2.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvpx-dev | deb | noble | 1.14.0-1ubuntu2.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvpx-doc | deb | noble | 1.14.0-1ubuntu2.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvpx9 | deb | noble | 1.14.0-1ubuntu2.1 | Not reported | Not reported | Not reported |
| Ubuntu | vpx-tools | deb | noble | 1.14.0-1ubuntu2.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvpx | deb | pro | 1.7.0-3ubuntu0.18.04.1+esm2 | Not reported | USN-7249-1 | Not reported |
| Ubuntu | libvpx | deb | pro | 1.7.0-3ubuntu0.18.04.1+esm2 | Not reported | UBUNTU-CVE-2024-5197 | Not reported |
| Ubuntu | libvpx | deb | 20.04 | 1.8.2-1ubuntu0.3 | Not reported | UBUNTU-CVE-2024-5197 | Not reported |
| Ubuntu | libvpx | deb | 22.04 | 1.11.0-2ubuntu2.3 | Not reported | UBUNTU-CVE-2024-5197 | Not reported |
| Ubuntu | libvpx | deb | 24.04 | 1.14.0-1ubuntu2.1 | Not reported | UBUNTU-CVE-2024-5197 | Not reported |
| Ubuntu | libvpx | deb | 20.04 | 1.8.2-1ubuntu0.3 | Not reported | USN-6814-1 | Not reported |
| Ubuntu | libvpx | deb | 22.04 | 1.11.0-2ubuntu2.3 | Not reported | USN-6814-1 | Not reported |
| Ubuntu | libvpx | deb | 24.04 | 1.14.0-1ubuntu2.1 | Not reported | USN-6814-1 | Not reported |
| Opensuse | libvpx | rpm | tumbleweed | 1.14.1-1.1 | Not reported | OPENSUSE-SU-2024:14100-1 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [libvpx7]Unknown
Source package: [libvpx]
Details (4)
1.12.0-1+deb12u5· amd64 · bookwormFixed · Fixed:
1.12.0-1+deb12u3usn · libvpx · debian · bookworm; usn · libvpx · debian · 12
1.12.0-1+deb12u5· arm64 · bookwormFixed · Fixed:
1.12.0-1+deb12u3usn · libvpx · debian · bookworm; usn · libvpx · debian · 12
1.12.0-1+deb12u5· amd64 · bookworm-securityFixed · Fixed:
1.12.0-1+deb12u3usn · libvpx · debian · bookworm; usn · libvpx · debian · 12
1.12.0-1+deb12u5· arm64 · bookworm-securityFixed · Fixed:
1.12.0-1+deb12u3usn · libvpx · debian · bookworm; usn · libvpx · debian · 12
- [libvpx-dev]Unknown
Source package: [libvpx]
Details (4)
1.12.0-1+deb12u5· amd64 · bookwormFixed · Fixed:
1.12.0-1+deb12u3usn · libvpx · debian · bookworm; usn · libvpx · debian · 12
1.12.0-1+deb12u5· arm64 · bookwormFixed · Fixed:
1.12.0-1+deb12u3usn · libvpx · debian · bookworm; usn · libvpx · debian · 12
1.12.0-1+deb12u5· amd64 · bookworm-securityFixed · Fixed:
1.12.0-1+deb12u3usn · libvpx · debian · bookworm; usn · libvpx · debian · 12
1.12.0-1+deb12u5· arm64 · bookworm-securityFixed · Fixed:
1.12.0-1+deb12u3usn · libvpx · debian · bookworm; usn · libvpx · debian · 12
- [libvpx-doc]Unknown
Source package: [libvpx]
Details (4)
1.12.0-1+deb12u5· all · bookwormFixed · Fixed:
1.12.0-1+deb12u3usn · libvpx · debian · bookworm; usn · libvpx · debian · 12
1.12.0-1+deb12u5· all · bookwormFixed · Fixed:
1.12.0-1+deb12u3usn · libvpx · debian · bookworm; usn · libvpx · debian · 12
1.12.0-1+deb12u5· all · bookworm-securityFixed · Fixed:
1.12.0-1+deb12u3usn · libvpx · debian · bookworm; usn · libvpx · debian · 12
1.12.0-1+deb12u5· all · bookworm-securityFixed · Fixed:
1.12.0-1+deb12u3usn · libvpx · debian · bookworm; usn · libvpx · debian · 12
- [vpx-tools]Unknown
Source package: [libvpx]
Details (4)
1.12.0-1+deb12u5· amd64 · bookwormFixed · Fixed:
1.12.0-1+deb12u3usn · libvpx · debian · bookworm; usn · libvpx · debian · 12
1.12.0-1+deb12u5· arm64 · bookwormFixed · Fixed:
1.12.0-1+deb12u3usn · libvpx · debian · bookworm; usn · libvpx · debian · 12
1.12.0-1+deb12u5· amd64 · bookworm-securityFixed · Fixed:
1.12.0-1+deb12u3usn · libvpx · debian · bookworm; usn · libvpx · debian · 12
1.12.0-1+deb12u5· arm64 · bookworm-securityFixed · Fixed:
1.12.0-1+deb12u3usn · libvpx · debian · bookworm; usn · libvpx · debian · 12
[Debian 13 (Trixie)]
- [libvpx9]Unknown
Source package: [libvpx]
Details (4)
1.15.0-2.1+deb13u1· amd64 · trixieFixed · Fixed:
1.14.1-1usn · libvpx · debian · 13
1.15.0-2.1+deb13u1· arm64 · trixieFixed · Fixed:
1.14.1-1usn · libvpx · debian · 13
1.15.0-2.1+deb13u1· amd64 · trixie-securityFixed · Fixed:
1.14.1-1usn · libvpx · debian · 13
1.15.0-2.1+deb13u1· arm64 · trixie-securityFixed · Fixed:
1.14.1-1usn · libvpx · debian · 13
- [libvpx-dev]Unknown
Source package: [libvpx]
Details (4)
1.15.0-2.1+deb13u1· amd64 · trixieFixed · Fixed:
1.14.1-1usn · libvpx · debian · 13
1.15.0-2.1+deb13u1· arm64 · trixieFixed · Fixed:
1.14.1-1usn · libvpx · debian · 13
1.15.0-2.1+deb13u1· amd64 · trixie-securityFixed · Fixed:
1.14.1-1usn · libvpx · debian · 13
1.15.0-2.1+deb13u1· arm64 · trixie-securityFixed · Fixed:
1.14.1-1usn · libvpx · debian · 13
- [libvpx-doc]Unknown
Source package: [libvpx]
Details (4)
1.15.0-2.1+deb13u1· all · trixieFixed · Fixed:
1.14.1-1usn · libvpx · debian · 13
1.15.0-2.1+deb13u1· all · trixieFixed · Fixed:
1.14.1-1usn · libvpx · debian · 13
1.15.0-2.1+deb13u1· all · trixie-securityFixed · Fixed:
1.14.1-1usn · libvpx · debian · 13
1.15.0-2.1+deb13u1· all · trixie-securityFixed · Fixed:
1.14.1-1usn · libvpx · debian · 13
- [vpx-tools]Unknown
Source package: [libvpx]
Details (4)
1.15.0-2.1+deb13u1· amd64 · trixieFixed · Fixed:
1.14.1-1usn · libvpx · debian · 13
1.15.0-2.1+deb13u1· arm64 · trixieFixed · Fixed:
1.14.1-1usn · libvpx · debian · 13
1.15.0-2.1+deb13u1· amd64 · trixie-securityFixed · Fixed:
1.14.1-1usn · libvpx · debian · 13
1.15.0-2.1+deb13u1· arm64 · trixie-securityFixed · Fixed:
1.14.1-1usn · libvpx · debian · 13
[openSUSE Tumbleweed]
- [libvpx12]Unknown
Source package: [libvpx]
Details (1)
1.16.0-1.4· x86_64 · tumbleweedUnknown · Fixed:
1.14.1-1.1Version impact unknown
usn · libvpx · opensuse · tumbleweed
- [libvpx12-32bit]Unknown
Source package: [libvpx]
Details (1)
1.16.0-1.4· x86_64 · tumbleweedUnknown · Fixed:
1.14.1-1.1Version impact unknown
usn · libvpx · opensuse · tumbleweed
- [libvpx-devel]Unknown
Source package: [libvpx]
Details (1)
1.16.0-1.4· x86_64 · tumbleweedUnknown · Fixed:
1.14.1-1.1Version impact unknown
usn · libvpx · opensuse · tumbleweed
- [vpx-tools]Unknown
Source package: [libvpx]
Details (1)
1.16.0-1.4· x86_64 · tumbleweedUnknown · Fixed:
1.14.1-1.1Version impact unknown
usn · libvpx · opensuse · tumbleweed
Observed:
References
- [https://access.redhat.com/errata/RHSA-2025:14138]
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2024_5941.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-5197]
- [https://osv.dev/vulnerability/DLA-3830-1]
- [https://osv.dev/vulnerability/DSA-5722-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2024-5197]
- [https://osv.dev/vulnerability/USN-6814-1]
- [https://osv.dev/vulnerability/USN-7249-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:14100-1]
- [https://security-tracker.debian.org/tracker/CVE-2024-5197]
- [https://ubuntu.com/security/notices/USN-6814-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1945.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]