CVE-2023-6349 is a high severity heap overflow in libvpx, the VP9 and VP8 codec library. Encoding a frame larger than the size the encoder was configured for can overflow a heap buffer. The record recommends upgrading libvpx to version 1.13.1 or above, and rebuilding any software that carries its own copy.
What's affected
- Product: libvpx from the WebM project.
- Trigger described in the record: encoding a frame with larger dimensions than the originally configured size using VP9.
- Fixed version named in the record: 1.13.1 or above. The record lists no lower bound, so treat every earlier release as in scope until the advisory says otherwise.
- Impact in the record: a denial of service rating (availability high, confidentiality and integrity none).
The record gives a CVSS 3.1 base score of 7.5 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
libvpx is rarely installed on its own. It sits underneath browsers, video tools, WebRTC stacks and media pipelines, often as a bundled copy. Start with the system package, then look for bundled copies.
pkg-config --modversion vpx
rpm -q libvpx
dpkg -l | grep -i libvpx
For applications that ship their own libvpx, check the vendor release notes or the software bill of materials for the libvpx version. A distribution may have backported the fix without changing the upstream version number, so a version below 1.13.1 on a distribution package is a prompt to read the distribution advisory, not proof of exposure.
What to do now
- Inventory every product in your estate that encodes video with libvpx, including container images and desktop apps.
- Upgrade libvpx to 1.13.1 or later, or install the distribution update that states it covers CVE-2023-6349.
- Rebuild and redeploy statically linked or vendored copies. Updating the system library does not change those.
- Where you control the encoder input, reject or normalise frame dimensions that differ from the configured size until you are patched.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-122 (Heap-based Buffer Overflow): Code writes past the end of a block of heap memory, which can corrupt neighbouring data and crash the process. ; CWE-787 (Out-of-bounds Write): Code writes outside the memory it owns, which can corrupt data, crash the program, or in some cases allow code execution.
The weakness is a heap-based buffer overflow that follows an out-of-bounds write. The encoder allocates buffers for the size it was told about, then receives a frame that does not match. When the code trusts the new dimensions instead of the configured ones, it writes past the end of the allocation.
The record rates the impact as availability only, so the practical risk is a crashed encoder process. That matters most for services that accept video from outside, such as transcoding backends, and less for a desktop app that only plays files. Memory corruption bugs can sometimes be pushed further, but the record does not say that here and neither do we.
Try it yourself
This demo shows how a dependency inventory surfaces components like libvpx that arrive through other software, so you can find every copy.
Click through it at your own pace, or open it full screen.
Quick check
Does this affect video playback or only encoding?
The record describes the trigger as encoding a frame whose dimensions are larger than the configured size. Software that only decodes is not described as affected, though it may still ship the same library, so check the advisory.
Is a distribution package version below 1.13.1 vulnerable?
Not necessarily. Distributions often backport fixes. Read the distribution security notice for CVE-2023-6349 before deciding.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
