CVE-2025-48174 Integer overflow in libavif
An integer overflow in libavif can lead to a buffer overflow, potentially allowing attackers to execute arbitrary code or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-48174?
CVE-2025-48174 is a medium-severity vulnerability in aomedia libavif, published on 16 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In libavif before 1.3.0, makeRoom in stream.c has an integer overflow and resultant buffer overflow in stream->offset+size.
Weakness: CWE-190
Which versions are affected by CVE-2025-48174?
It affects 1 product.
Linux distribution packages (1)
libavif openSUSE:Tumbleweed | All versions | 1.3.0-2.1 |
Products include Aomedia Libavif.
How do I fix CVE-2025-48174?
Upgrade to a fixed version.
Is CVE-2025-48174 being exploited?
There is no known exploitation of CVE-2025-48174 in the wild and no public exploit code.
Other vulnerabilities in aomedia libavif
Sources
Also known as DEBIAN-CVE-2025-48174, ECHO-e3e3-da97-93f7, GHSA-f6x7-5x3c-j3rg, JLSEC-2026-125, MINI-49f8-fv65-44j7, UBUNTU-CVE-2025-48174 and 1 more.