CVE-2025-48175 Integer overflow in libavif
Integer overflows in libavif's RGB to YUV conversion can lead to crashes or potential code execution when processing malicious images.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-48175?
CVE-2025-48175 is a medium-severity vulnerability in aomedia libavif, published on 16 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In libavif before 1.3.0, avifImageRGBToYUV in reformat.c has integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes.
Weakness: CWE-190
Which versions are affected by CVE-2025-48175?
It affects 1 product.
Linux distribution packages (1)
libavif openSUSE:Tumbleweed | All versions | 1.3.0-3.1 |
Products include Aomedia Libavif.
How do I fix CVE-2025-48175?
Upgrade to a fixed version.
Is CVE-2025-48175 being exploited?
There is no known exploitation of CVE-2025-48175 in the wild and no public exploit code.
Other vulnerabilities in aomedia libavif
Sources
Also known as DEBIAN-CVE-2025-48175, ECHO-fbb1-8d31-9c3d, GHSA-44mp-2g68-7wvv, GHSA-762c-2538-h844, JLSEC-2026-126, MINI-5wgh-rvqp-g55g and 2 more.