CVE-2023-6879

A heap-based buffer overflow vulnerability was found in AOM. When increasing the resolution of video frames during a multi-threaded encode, a heap overflow may occur in av1_loop_restoration_dealloc() within thread_common.c, leading to a denial of service or unauthorized reading of memory.

The AOM heap-based buffer overflow vulnerability, triggered when increasing video frame resolution during a multi-threaded encode, is considered moderate. Limited conditions for exploitation and constrained impacts, such as potential denial of service and unauthorized memory reading, contribute to this classification. The issue is not universally exploitable, requiring specific circumstances, and does not immediately lead to widespread system compromise.

Mozilla Firefox & Thunderbird don't have any AV1 encode paths currently, so Red Hat Enterprise Linux 7, 8 & 9 is not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.