CVE-2023-6879: aomedia Improper Input Validation
CVSS: 9.8v3.1CriticalModified
AliasesSUSE-SU-2024:0517-1SUSE-SU-2024:4333-1UBUNTU-CVE-2023-6879DEBIAN-CVE-2023-6879
Published 27-12-2023Last modified 23-06-2026
Vulnerability summary
CVE-2023-6879 is a critical (CVSS 9.8) Improper Input Validation vulnerability in aomedia. EPSS estimates a 1.18% chance of exploitation in the next 30 days, higher than 67.1% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
1.18%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 27-12-2023PublishedVulnerability first disclosed.
- 23-06-2026Last modifiedVulnerability information updated.
Description
Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc().
CVSS metrics
4 scores · 4 sources · 1 versionCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources4 sources · 9.0–9.8
- CVE.orgCNA9.0CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.18%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
0.00 pp
From 1.18% on 20-09-2026
20-09-202620-10-2026
EPSS score1.18%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (crbug.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Suse22 products
- libaom-devel-doc&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 3.7.1-150400.3.9.1
- libaom-devel-doc&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 3.7.1-150400.3.9.1
- libaom-devel-doc&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5< 3.7.1-150400.3.9.1
- libaom-devel-doc&distro=SUSE Linux Enterprise Server 15 SP4-LTSS< 3.7.1-150400.3.9.1
- libaom-devel-doc&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4< 3.7.1-150400.3.9.1
Opensuse3 products
- libaom-devel-doc&distro=openSUSE Leap 15.5< 3.7.1-150400.3.9.1
- libaom&distro=openSUSE Leap 15.5< 3.7.1-150400.3.9.1 | < 3.2.0-150400.3.3.1
- libyuv&distro=openSUSE Leap 15.5< 20230517+a377993-150400.9.3.1
Aomedia1 product
- aomedia< 3.7.1
Debian1 product
- aomAll versions (No fix recorded) | < 3.7.1-1
Fedoraproject1 product
- fedoraEOL38 | 39
Libaom1 product
- libaom< 3.7.1
Ubuntu1 product
- aomAll versions (No fix recorded)
7 vendors · 30 products
