Fuzzanything

**Name of the Vulnerable Software and Affected Versions** libaom (affected versions not specified) **Description** A heap buffer overflow occurs in the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode allows the first-pass stats ring buffer wrap-around guard to be bypassed when the `g lag in frames` variable is set to 1 or higher. This leads to a 232-byte out-of-bounds write on every encoded frame after the second, which corrupts adjacent heap objects. An attacker capable of influencing encoder configuration in a WebRTC session or transcoding service could cause a denial of service via a process crash or potentially achieve code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libaom (affected versions not specified) **Description** An arbitrary address write issue exists in the reference AV1 codec implementation. A missing bounds check in the Scalable Video Coding (SVC) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field by using crafted image pixel values. Consequently, the encoder writes approximately 1,200 bytes to an address controlled by the attacker. This process is fully deterministic and does not require a separate information leak. An attacker providing frames to a network-facing encoder with SVC enabled could cause a denial of service or achieve potential code execution. **Recommendations** Apply the aomedia patched build (commit a93ba0ffaa) or a vendor update. As a temporary mitigation, disable SVC in the libaom encoder.

**Name of the Vulnerable Software and Affected Versions** libaom (affected versions not specified) **Description** A heap-buffer-overflow read occurs in the reference AV1 codec implementation due to a missing bounds check in the SVC (Scalable Video Coding) layer ID control function. This allows the `spatial layer id` to be set beyond the configured number of layers, resulting in an out-of-bounds heap read of approximately 40,728 bytes during the computation of a layer context array index. An attacker capable of influencing SVC encoder parameters in a network-facing service could leverage this to cause a denial of service via a segmentation fault or achieve information disclosure through a heap content leak. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.