OpenAPV EUVD-2026-91869

Exploitation requires the OpenAPV decoder (oapvd / the oapv_app_dec application) to parse an attacker-crafted APV bitstream on versions before 1.1.1.0; the malformed stream signals frame width/height or VLC coefficient values that overflow an int size calculation and bypass the buffer-size check in read_bitstream. The key limiting factor is the LOCAL attack vector (AV:L): the attacker cannot trigger this remotely without first delivering the malicious file to a workflow or tool that decodes it. No special non-default configuration or authentication is required (PR:N) - any decode of untrusted APV input on an affected build is sufficient - but the realistic impact is constrained (vendor-rated LOW C/I/A), pointing to crash or limited corruption rather than straightforward code execution.

This is a medium-severity, low-priority issue in practical terms. The vendor-supplied CVSS 4.0 vector (base 5.1) rates attack vector as LOCAL (AV:L), meaning an attacker cannot reach the flaw over a network directly - a maliciously crafted APV bitstream must be delivered to and processed by the OpenAPV decoder on the target host. Although PR:N indicates no privileges are required, the local vector and the conservative impact ratings (VC:L/VI:L/VA:L) sharply limit real-world risk: a heap-based buffer overflow driven by an integer overflow (CWE-190) most plausibly results in a decoder crash or limited memory corruption rather than reliable remote code execution, which is consistent with the vendor scoring only LOW across confidentiality, integrity, and availability. No EPSS score, CISA KEV listing, or public exploit was provided in the input, so there is no signal of active or probable widespread exploitation. The signals are internally consistent - there is no CVSS-vs-description conflict - but the LOW impact metrics for a heap overflow are notably conservative; defenders handling untrusted video with this decoder should still patch, while treating this as routine hardening rather than an urgent threat.

An attacker crafts a malformed APV bitstream in which signaled frame dimensions or VLC coefficient values trigger an integer overflow that bypasses the decoder's buffer-size check. When a victim decodes this file with a vulnerable OpenAPV build (before 1.1.1.0) - for example via the oapv_app_dec tool or an integrated decode pipeline - the undersized allocation is overflowed in read_bitstream, corrupting the heap. No public exploit code was identified in the provided data, and the local attack vector means the attacker must first get the file onto a system where it will be decoded.