Openapv
Monthly
Decoding an attacker-crafted APV bitstream with the Academy Software Foundation's OpenAPV reference implementation before version 1.1.1.0 can overflow a heap buffer in the read_bitstream/decoder path, because integer wraparound in the frame buffer-size calculation lets a too-small allocation pass the internal size check. The affected component is the oapvd decoder and the oapv_app_dec sample application; no authentication or non-default configuration is required, but the attack vector is local (AV:L), so exploitation requires the victim to open or process a malicious .apv-style file. Vendor-rated impact is limited (low confidentiality, integrity, and availability per the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L vector), consistent with a crash or constrained memory corruption rather than reliable code execution, and no public exploit code or CISA KEV active-exploitation record was identified at time of analysis.
Decoding an attacker-crafted APV bitstream with the Academy Software Foundation's OpenAPV reference implementation before version 1.1.1.0 can overflow a heap buffer in the read_bitstream/decoder path, because integer wraparound in the frame buffer-size calculation lets a too-small allocation pass the internal size check. The affected component is the oapvd decoder and the oapv_app_dec sample application; no authentication or non-default configuration is required, but the attack vector is local (AV:L), so exploitation requires the victim to open or process a malicious .apv-style file. Vendor-rated impact is limited (low confidentiality, integrity, and availability per the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L vector), consistent with a crash or constrained memory corruption rather than reliable code execution, and no public exploit code or CISA KEV active-exploitation record was identified at time of analysis.