CVE-2025-48175

6.5 mediumEPSS 0.3%

Medium (6.5) in aomedia libavif. EPSS 0.3% chance of exploitation in the next 30 days.

In libavif before 1.3.0, avifImageRGBToYUV in reformat.c has integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
CWE: CWE-190
Published: 2025-05-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

aomedia:libavif

References

https://github.com/AOMediaCodec/libavif/commit/64d956ed5a602f78cebf29da023280944ee92efd
https://github.com/AOMediaCodec/libavif/pull/2769
https://github.com/AOMediaCodec/libavif/security/advisories/GHSA-762c-2538-h844
https://lists.debian.org/debian-lts-announce/2025/05/msg00031.html

Check your stack JSON