CVE-2025-48175 Overview
CVE-2025-48175 is an integer overflow vulnerability in libavif, the AV1 Image File Format (AVIF) reference library maintained by the Alliance for Open Media (AOMedia). The flaw resides in the avifImageRGBToYUV function in reformat.c and affects versions of libavif prior to 1.3.0. Multiplications involving the rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes variables can overflow when processing images with large dimensions or row stride values. The vulnerability is classified as [CWE-190] Integer Overflow or Wraparound. It is exploitable over a network attack vector when an application decodes an attacker-supplied AVIF image.
Critical Impact
A remote attacker can trigger memory corruption by supplying a crafted AVIF image, potentially leading to information disclosure or denial of service in applications that link against vulnerable libavif builds.
Affected Products
- AOMedia libavif versions prior to 1.3.0
- Debian LTS distributions shipping vulnerable libavif packages
- Downstream applications and image processing pipelines that embed libavif for AVIF decoding
Discovery Timeline
- 2025-05-16 - CVE-2025-48175 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-48175
Vulnerability Analysis
The vulnerability affects avifImageRGBToYUV, the conversion routine that transforms RGB pixel data into the YUV color space during AVIF encoding operations. Row stride values (rgbRowBytes, yRowBytes, uRowBytes, vRowBytes) were declared as uint32_t. When these values are multiplied by row indices or plane dimensions during buffer offset calculation, the result can exceed the 32-bit unsigned integer range and wrap around. The overflow produces an incorrect offset used to index into pixel plane buffers. Subsequent read or write operations reference memory outside the intended allocation, yielding a low-impact integrity and availability compromise in the process performing the conversion.
Root Cause
The root cause is the use of 32-bit integer types for values that represent byte offsets into potentially large image buffers. On 64-bit systems, pointer arithmetic operates on size_t, but intermediate 32-bit multiplications silently truncate before the promotion occurs. The patch changes each RowBytes declaration from uint32_t to size_t, ensuring multiplications are performed at pointer width and do not wrap.
Attack Vector
An attacker delivers a crafted AVIF image to a target application that invokes libavif's RGB-to-YUV conversion path. Delivery vectors include web content, email attachments, messaging platforms, and file-processing services. No authentication or user interaction beyond opening or processing the image is required by the library itself.
// Security patch in src/reformat.c
// Declare *RowBytes as size_t in avifImageRGBToYUV()
const uint32_t offsetBytesG = state.rgb.offsetBytesG;
const uint32_t offsetBytesB = state.rgb.offsetBytesB;
const uint32_t offsetBytesA = state.rgb.offsetBytesA;
- const uint32_t rgbRowBytes = rgb->rowBytes;
+ const size_t rgbRowBytes = rgb->rowBytes;
const float rgbMaxChannelF = state.rgb.maxChannelF;
uint8_t * yPlane = image->yuvPlanes[AVIF_CHAN_Y];
uint8_t * uPlane = image->yuvPlanes[AVIF_CHAN_U];
uint8_t * vPlane = image->yuvPlanes[AVIF_CHAN_V];
- const uint32_t yRowBytes = image->yuvRowBytes[AVIF_CHAN_Y];
- const uint32_t uRowBytes = image->yuvRowBytes[AVIF_CHAN_U];
- const uint32_t vRowBytes = image->yuvRowBytes[AVIF_CHAN_V];
+ const size_t yRowBytes = image->yuvRowBytes[AVIF_CHAN_Y];
+ const size_t uRowBytes = image->yuvRowBytes[AVIF_CHAN_U];
+ const size_t vRowBytes = image->yuvRowBytes[AVIF_CHAN_V];
for (uint32_t outerJ = 0; outerJ < image->height; outerJ += 2) {
for (uint32_t outerI = 0; outerI < image->width; outerI += 2) {
uint32_t blockW = 2, blockH = 2;
Source: AOMedia libavif commit 64d956e
Detection Methods for CVE-2025-48175
Indicators of Compromise
- Application crashes or unexpected termination in processes that decode or encode AVIF images using libavif
- AVIF files with unusually large declared width, height, or row stride values relative to file size
- Memory access violations logged by host OS or sandbox when handling untrusted AVIF content
Detection Strategies
- Inventory installed libavif versions across endpoints, servers, and container images and flag any build below 1.3.0
- Inspect software bills of materials (SBOMs) for downstream applications that statically link libavif prior to 1.3.0
- Monitor image-processing services for abnormal crash rates correlated with AVIF file ingestion
Monitoring Recommendations
- Enable core-dump collection for image decoding services and analyze faults touching avifImageRGBToYUV
- Log AVIF file metadata (dimensions, stride) at the ingress layer and alert on outliers
- Track package updates via distribution security channels, including the Debian LTS Announcement
How to Mitigate CVE-2025-48175
Immediate Actions Required
- Upgrade libavif to version 1.3.0 or later on all systems, container images, and build pipelines
- Apply distribution security updates such as the Debian LTS package release for affected libavif builds
- Rebuild and redeploy any application that statically links libavif so the fix propagates to production binaries
Patch Information
The fix is included in libavif 1.3.0 and was merged through Pull Request #2769 with commit 64d956e. Details are documented in GitHub Security Advisory GHSA-762c-2538-h844. The patch changes affected row-byte variables in avifImageRGBToYUV from uint32_t to size_t to prevent 32-bit multiplication overflow.
Workarounds
- Restrict AVIF image ingestion from untrusted sources until libavif is updated
- Enforce maximum image dimension and file-size limits at application ingress to reduce the practicality of triggering the overflow
- Run image decoding in sandboxed or containerized processes so a crash does not affect the parent service
# Verify installed libavif version and update on Debian-based systems
dpkg -l | grep libavif
sudo apt-get update && sudo apt-get install --only-upgrade libavif16 libavif-dev
# Verify from source builds
avifenc --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
