CVE-2013-0899: Integer overflow in the padding implementation in the opus_packet_parse_impl function in src/opus_decoder.c in

Q: How do I fix CVE-2013-0899?

opus: upgrade to 1.0.2; chrome: upgrade to 25.0.1364.97, 25.0.1364.99; opensuse: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Q: Is CVE-2013-0899 being exploited?

CVE-2013-0899 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2013-0899 affect?

CVE-2013-0899 affects opus, chrome, opensuse. Severity is medium (CVSS 5.0). Integer overflow in the padding implementation in the opus_packet_parse_impl function in src/opus_decoder.c in Opus before 1.0.2, as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X and othe

Q: How urgent is CVE-2013-0899?

Priority 36/100. No elevated risk signals yet.

Routine

MEDIUM 5.0UPGRADEUPGRADEMITIGATE

CVE-2013-0899 is a medium-severity flaw (CVSS 5.0) affecting opus, chrome, opensuse. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Integer overflow in the padding implementation in the opus_packet_parse_impl function in src/opus_decoder.c in Opus before 1.0.2, as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a long packet.

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	5.0 (Medium)
EPSS exploit chance	1.5% (top 26%)
CISA exploited list	No
Weakness	CWE-190
Published	2013-02-23
Last modified	2026-06-16

Publisher (CNA): Chrome · Vendor: google · opensuse · opus-codec

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2013-02-23 21:55 UTCPublished CVE record published
2026-06-16 23:50 UTCUpdated Record last modified

opus-codec opus UPGRADE

Affected: < 1.0.2

Fixed in: 1.0.2

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy opus || rpm -q opus || opus --version

2. UPGRADE to 1.0.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade opus

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade opus

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

google chrome UPGRADE

Affected: < 25.0.1364.97 · < 25.0.1364.99

Fixed in: 25.0.1364.97, 25.0.1364.99

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy chrome || rpm -q chrome || chrome --version

2. UPGRADE to 25.0.1364.97 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade chrome

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade chrome

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

opensuse opensuse MITIGATE

Affected: 12.1 · 12.2

Fixed in: no fixed release known

Safe to downgrade to: a release before 12.1

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2013-0899?

opus: upgrade to 1.0.2; chrome: upgrade to 25.0.1364.97, 25.0.1364.99; opensuse: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2013-0899 being exploited?

CVE-2013-0899 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2013-0899 affect?

CVE-2013-0899 affects opus, chrome, opensuse. Severity is medium (CVSS 5.0). Integer overflow in the padding implementation in the opus_packet_parse_impl function in src/opus_decoder.c in Opus before 1.0.2, as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X and othe

How urgent is CVE-2013-0899?

Priority 36/100. No elevated risk signals yet.

Software pages

Windows vulnerabilities · Google Chrome vulnerabilities

Related CVEs

CVE-2022-25345 HIGH 7.5 MITIGATE All versions of package @discordjs/opus are vulnerable to Denial of Service (DoS) when trying to encode using

References

← Back to latest CVEs