CVE-2025-48174 is a medium severity integer overflow (CVSS 4.5) in libavif before 1.3.0, the library used to read and write AVIF images. In the makeRoom function of stream.c, an overflow in a size calculation leads to a buffer overflow. Upgrade to libavif 1.3.0 or later.
What's affected
Per the CVE record, libavif versions before 1.3.0 are affected, so 1.3.0 is the first release without the issue. The record describes an integer overflow in the makeRoom function in stream.c, in the expression that adds a stream offset and a size, with a resulting buffer overflow.
The record files it under CWE-190 (Integer Overflow or Wraparound). The references include three commits, a pull request and a Debian LTS announcement, which points to distributions shipping fixes for older library versions. If you use a packaged libavif, your operating system vendor may have back ported the change without moving to 1.3.0, so read the vendor advisory for your distribution.
The base vector is CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L. The attack vector is local and the complexity is high, with a changed scope and low impact on integrity and availability. That is why the score is medium.
How to check if you're exposed
Check the library version on a host:
pkg-config --modversion libavif
dpkg -l | grep -i libavif
rpm -qa | grep -i libavif
Only the last two that match your distribution will apply. If the version is below 1.3.0, check your distribution's security tracker to see whether it carries a back ported fix under the same version number.
libavif is often included without anyone choosing it. Image libraries, browsers, media tools and language packages can bundle their own copy, so check lock files and application folders as well as the system packages. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull in the affected component.
What to do now
- Upgrade libavif to 1.3.0 or later, or install your distribution update that references CVE-2025-48174.
- Rebuild and redeploy applications and images that statically link or bundle libavif.
- Find where your software decodes AVIF files from outside sources, such as uploads and thumbnails.
- Where updating takes time, limit AVIF handling in services that process untrusted images, or isolate them in a low privilege process.
- Re-scan your projects after the update to confirm no older copy remains in the build.
Why it matters
An integer overflow occurs when a calculation produces a number too large for its type, so the value wraps around to something small. If that number is then used to decide how much memory to reserve, the program can reserve less than it needs and later write past the end. That is the chain here: an addition in a size calculation, followed by a buffer overflow.
The score is medium because the vector is local, the complexity is high and the impact is limited. Image libraries still deserve prompt updates, because they sit behind features that handle files from outside, and the same library can be reached by many applications at once.
It is not listed in the CISA Known Exploited Vulnerabilities catalog, and the record does not report exploitation in the wild. A single shared library in many places is the textbook case for a software inventory: the fix is one version number, and the hard part is finding every copy.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is 1.3.0 the fixed version?
The record says versions before 1.3.0 are affected, so 1.3.0 is the first release without the issue as described. Distributions may carry a fix under an older number.
Why is the score only medium?
The vector is local with high attack complexity and limited impact. The score reflects that, not the ease of fixing it.
Sources
- NVD record for CVE-2025-48174
- github.com reference
- github.com reference
- github.com reference
- github.com reference
- lists.debian.org reference
Last reviewed: 18 October 2026.
