CVE-2023-6349

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-122 CWE-787

Affected software

Vendor	Product	Versions
Chromium	libvpx	>= 1.5.0, < 1.13.1

References

https://crbug.com/webm/1642Exploit, Issue Tracking
https://crbug.com/webm/1642Exploit, Issue Tracking

Timeline

Published: May 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-63508.8Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a cr CVE-2023-63518.8Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a cr CVE-2023-63525.3The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet I CVE-2023-63539.4Tyler Technologies Civil and Criminal Electronic Filing allows an unauthenticated, remote attacker to upload, delete, and view files by mani CVE-2023-63549.4Tyler Technologies Magistrate Court Case Management Plus allows an unauthenticated, remote attacker to upload, delete, and view files by man CVE-2023-63556.8Incorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local d CVE-2023-63567.5A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP pac CVE-2023-63578.8A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could CVE-2023-63596.1A Cross-Site Scripting (XSS) vulnerability has been found in Alumne LMS affecting version 4.0.0.1.08. An attacker could exploit the 'localid CVE-2023-63609.8The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' pa CVE-2023-63617.3A vulnerability has been discovered in Winhex affecting version 16.1 SR-1 and 20.4. This vulnerability consists of a buffer overflow control CVE-2023-63627.3A vulnerability has been discovered in Winhex affecting version 16.1 SR-1 and 20.4. This vulnerability consists of a buffer overflow control