CVE-2020-36131

Vulnerability

A stack buffer overflow vulnerability exists in AOM (Alliance for Open Media's AV1 Codec SDK) version 2.0.1 in the file stats/rate_hist.c. The issue is reachable when processing certain crafted input, leveraging the rate histogram stats component. Affected version: AOM v2.0.1. [1]

Exploitation

An attacker could trigger the overflow by providing a specially crafted media file (AV1 encoded stream) to an application using AOM for decoding and stats processing. No authentication is required; the attack vector is network-based via file delivery. The exact sequence for exploitation is not detailed in the references, but it relies on the vulnerable code path in the rate histogram stats. [1]

Impact

Successful exploitation could lead to remote code execution in the context of the application using the library. This fully compromises confidentiality, integrity, and availability. The vulnerability has a high severity (CVSS details not provided in the given info, but related Gentoo advisory notes "worst can lead to remote code execution"). [1]

Mitigation

The vulnerability is fixed in libaom version 3.2.0 and later. Gentoo users should upgrade media-libs/libaom to >=3.2.0. No workaround is available. The CVE is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date. [1]