PatchTheCVE: libbpghttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2017-2575: A vulnerability was found while fuzzing libbpg 0.9.7https://patchthecve.com/cve/CVE-2017-2575.htmlhttps://patchthecve.com/cve/CVE-2017-2575.htmlWed, 17 Jun 2026 01:16:25 +0000MEDIUM 6.5: A vulnerability was found while fuzzing libbpg 0.9.7. It is a NULL pointer dereference issue due to missing check of the return value of function malloc in the BPG encoder. This vulnerability appeared while converting a malicious JPEG file to BPG.CVE-2018-12447: The restore_tqb_pixels function in hevc_filter.c in libavcodec, as used in libbpg 0.9.8 and other products, hahttps://patchthecve.com/cve/CVE-2018-12447.htmlhttps://patchthecve.com/cve/CVE-2018-12447.htmlWed, 17 Jun 2026 01:37:48 +0000HIGH 8.8: The restore_tqb_pixels function in hevc_filter.c in libavcodec, as used in libbpg 0.9.8 and other products, has an integer overflow that leads to a heap-based buffer overflow and remote code execution.CVE-2017-14034: The restore_tqb_pixels function in hevc_filter.c in libavcodec, as used in libbpg 0.9.7 and other products, mihttps://patchthecve.com/cve/CVE-2017-14034.htmlhttps://patchthecve.com/cve/CVE-2017-14034.htmlWed, 17 Jun 2026 01:05:28 +0000HIGH 8.8: The restore_tqb_pixels function in hevc_filter.c in libavcodec, as used in libbpg 0.9.7 and other products, miscalculates a memcpy destination address, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other imCVE-2017-13136: The image_alloc function in bpgenc.c in libbpg 0.9.7 has an integer overflow, with a resultant invalid malloc https://patchthecve.com/cve/CVE-2017-13136.htmlhttps://patchthecve.com/cve/CVE-2017-13136.htmlWed, 17 Jun 2026 01:04:34 +0000HIGH 8.8: The image_alloc function in bpgenc.c in libbpg 0.9.7 has an integer overflow, with a resultant invalid malloc and NULL pointer dereference.CVE-2017-13135: A NULL Pointer Dereference exists in VideoLAN x265, as used in libbpg 0.9.7 and other products, because the CUhttps://patchthecve.com/cve/CVE-2017-13135.htmlhttps://patchthecve.com/cve/CVE-2017-13135.htmlWed, 17 Jun 2026 01:04:34 +0000HIGH 7.8: A NULL Pointer Dereference exists in VideoLAN x265, as used in libbpg 0.9.7 and other products, because the CUData::initialize function in common/cudata.cpp mishandles memory-allocation failure.CVE-2017-14796: The hevc_write_frame function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of servicehttps://patchthecve.com/cve/CVE-2017-14796.htmlhttps://patchthecve.com/cve/CVE-2017-14796.htmlWed, 17 Jun 2026 01:06:46 +0000HIGH 8.8: The hevc_write_frame function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (integer underflow and application crash) or possibly have unspecified other impact via a crafted BPG file, related to improper interaction with copy_CTB_to_hv in hevc_filter.c in libavcodeCVE-2017-14795: The hevc_write_frame function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of servicehttps://patchthecve.com/cve/CVE-2017-14795.htmlhttps://patchthecve.com/cve/CVE-2017-14795.htmlWed, 17 Jun 2026 01:06:46 +0000HIGH 8.8: The hevc_write_frame function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted BPG file, related to improper interaction with hls_pcm_sample in hevc.c in libavcodec in FCVE-2017-14734: The build_msps function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (heaphttps://patchthecve.com/cve/CVE-2017-14734.htmlhttps://patchthecve.com/cve/CVE-2017-14734.htmlWed, 17 Jun 2026 01:06:41 +0000HIGH 8.8: The build_msps function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted BPG file, related to hevc_decode_init1.