CVE-2024-5197 Integer overflow in libvpx

Medium 5.9 Published 3 Jun 2024 Updated 13 Feb 2025

Integer overflows in libvpx image allocation functions can lead to invalid struct fields, potentially causing memory corruption or crashes.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2024-5197?

CVE-2024-5197 is a medium-severity vulnerability in Debian Debian Linux, published on 3 Jun 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calling vpx_img_wrap() with a large value of the d_w, d_h, or stride_align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. We recommend upgrading to version 1.14.1 or beyond

Weakness: CWE-190

Which versions are affected by CVE-2024-5197?

It affects 2 products.

Linux distribution packages (28)

`libvpx` AlmaLinux:9	All versions	`1.9.0-8.el9_5`
`libvpx-devel` AlmaLinux:9	All versions	`1.9.0-8.el9_5`
`libvpx` Red Hat:enterprise_linux:9::appstream	All versions	`0:1.9.0-8.el9_5`
`libvpx-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:1.9.0-8.el9_5`
`libvpx-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:1.9.0-8.el9_5`
`libvpx-utils-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:1.9.0-8.el9_5`
`libvpx-debuginfo` Red Hat:enterprise_linux:9::crb	All versions	`0:1.9.0-8.el9_5`
`libvpx-debugsource` Red Hat:enterprise_linux:9::crb	All versions	`0:1.9.0-8.el9_5`
`libvpx-devel` Red Hat:enterprise_linux:9::crb	All versions	`0:1.9.0-8.el9_5`
`libvpx-utils-debuginfo` Red Hat:enterprise_linux:9::crb	All versions	`0:1.9.0-8.el9_5`
`libvpx` Red Hat:rhel_e4s:9.0::appstream	All versions	`0:1.9.0-7.el9_0.2`
`libvpx-debuginfo` Red Hat:rhel_e4s:9.0::appstream	All versions	`0:1.9.0-7.el9_0.2`
`libvpx-debugsource` Red Hat:rhel_e4s:9.0::appstream	All versions	`0:1.9.0-7.el9_0.2`
`libvpx-utils-debuginfo` Red Hat:rhel_e4s:9.0::appstream	All versions	`0:1.9.0-7.el9_0.2`
`libvpx` Red Hat:rhel_e4s:9.2::appstream	All versions	`0:1.9.0-7.el9_2.2`
`libvpx-debuginfo` Red Hat:rhel_e4s:9.2::appstream	All versions	`0:1.9.0-7.el9_2.2`
`libvpx-debugsource` Red Hat:rhel_e4s:9.2::appstream	All versions	`0:1.9.0-7.el9_2.2`
`libvpx-utils-debuginfo` Red Hat:rhel_e4s:9.2::appstream	All versions	`0:1.9.0-7.el9_2.2`
`libvpx` Red Hat:rhel_eus:9.4::appstream	All versions	`0:1.9.0-7.el9_4.2`
`libvpx-debuginfo` Red Hat:rhel_eus:9.4::appstream	All versions	`0:1.9.0-7.el9_4.2`
`libvpx-debugsource` Red Hat:rhel_eus:9.4::appstream	All versions	`0:1.9.0-7.el9_4.2`
`libvpx-utils-debuginfo` Red Hat:rhel_eus:9.4::appstream	All versions	`0:1.9.0-7.el9_4.2`
`libvpx-debuginfo` Red Hat:rhel_eus:9.4::crb	All versions	`0:1.9.0-7.el9_4.2`
`libvpx-debugsource` Red Hat:rhel_eus:9.4::crb	All versions	`0:1.9.0-7.el9_4.2`
`libvpx-devel` Red Hat:rhel_eus:9.4::crb	All versions	`0:1.9.0-7.el9_4.2`
`libvpx-utils-debuginfo` Red Hat:rhel_eus:9.4::crb	All versions	`0:1.9.0-7.el9_4.2`
`libvpx` Rocky Linux:9	All versions	`0:1.9.0-8.el9_5`
`libvpx` openSUSE:Tumbleweed	All versions	`1.14.1-1.1`

Products include Debian Debian Linux, Webmproject Libvpx.

How do I fix CVE-2024-5197?

Upgrade to a fixed version.

Is CVE-2024-5197 being exploited?

There is no known exploitation of CVE-2024-5197 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as ALSA-2024:9827, AZL-42958, AZL-42963, CLSA-2025-1755003990, CLSA-2026-1777973407, DEBIAN-CVE-2024-5197 and 15 more.