CVE-2024-5197: Integer overflow in libvpx

There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpximgalloc() with a large value of the dw, dh, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpximaget struct may be invalid. Calling vpximgwrap() with a large value of the dw, dh, or stridealign parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpximaget struct may be invalid. We recommend upgrading to version 1.14.1 or beyond

— Launchpad

WebM Project libvpx could allow a local authenticated attacker to execute arbitrary code on the system, caused by an integer overflow in the vpximgalloc() function. By sending a specially crafted request using the dw, dh, or align parameters, an attacker could exploit this vulnerability to execute arbitrary code on the system.

— IBM