https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-5197.htmlhttps://patchthecve.com/cve/CVE-2024-5197.htmlWed, 17 Jun 2026 08:15:23 +0000CRITICAL 9.1: There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpx_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpx_image_t struct may be invalid. Calhttps://patchthecve.com/cve/CVE-2023-6349.htmlhttps://patchthecve.com/cve/CVE-2023-6349.htmlWed, 17 Jun 2026 06:50:35 +0000HIGH 7.5: A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or abovehttps://patchthecve.com/cve/CVE-2023-44488.htmlhttps://patchthecve.com/cve/CVE-2023-44488.htmlWed, 17 Jun 2026 06:27:44 +0000HIGH 7.5: VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding.https://patchthecve.com/cve/CVE-2023-1999.htmlhttps://patchthecve.com/cve/CVE-2023-1999.htmlWed, 17 Jun 2026 05:29:14 +0000MEDIUM 5.3: There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial