Aomedia Libavif — known CVE vulnerabilities

Every CVE whose affected-product data names Aomedia Libavif, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (3)

• CVE-2020-36407 — CVSS 8.8 (high): libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid.
• CVE-2025-48174 — CVSS 4.5 (medium): In libavif before 1.3.0, makeRoom in stream.c has an integer overflow and resultant buffer overflow in stream->offset+size.
• CVE-2025-48175 — CVSS 4.5 (medium): In libavif before 1.3.0, avifImageRGBToYUV in reformat.c has integer overflows in multiplications involving rgbRowBytes, yRowBytes…