CVE-2012-0823: Webmproject Libvpx

Medium severity, CVSS 5.0. EPSS: 2.5% chance of exploitation in the next 30 days.

VP8 Codec SDK (libvpx) before 1.0.0 "Duclair" allows remote attackers to cause a denial of service (application crash) via (1) unspecified "corrupt input" or (2) by "starting decoding from a P-frame," which triggers an out-of-bounds read, related to "the clamping of motion vectors in SPLITMV blocks".

Affected products

• Webmproject Libvpx: up to and including 0.9.7; version 0.9.0 only; version 0.9.1 only; version 0.9.2 only; version 0.9.5 only; version 0.9.6 only; …

Published 2012-02-23. Last modified 2026-06-16.