CVE-2025-48175: Integer Overflow
Published May 16, 2025
·Updated
In libavif before 1.3.0, avifImageRGBToYUV in reformat.c has integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes.
Affected Software
2 affected components
AOMedia Libavif<1.3.0
AOMedia Libavif<1.3.0
Remediation
Patch Available
Event History
May 16, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-48175?
CVE-2025-48175 is classified as a medium severity vulnerability.
2
How do I fix CVE-2025-48175?
To remediate CVE-2025-48175, update the libavif library to version 1.3.0 or later.
3
What causes the vulnerability in CVE-2025-48175?
CVE-2025-48175 is caused by integer overflows in the avifImageRGBToYUV function, leading to potential memory corruption.
4
Which versions of libavif are affected by CVE-2025-48175?
Versions of libavif prior to 1.3.0 are affected by CVE-2025-48175.
5
What impact does CVE-2025-48175 have on applications using libavif?
CVE-2025-48175 may allow attackers to exploit the vulnerability to cause application crashes or execute arbitrary code.