A critical denial-of-service vulnerability in the libvpx VP9 encoder — tracked as CVE-2023-44488 — allows specially crafted input to crash the encoder in libvpx versions prior to 1.13.1, posing a real availability risk for any service or application that performs VP9 encoding or otherwise embeds...
Google’s disclosure of CVE-2026-1861 — a heap buffer overflow in libvpx — is small, but it matters: the bug was fixed in Chrome’s Stable channel (build 144.0.7559.132) and appears in multiple vendor tracking feeds, and Microsoft has listed the CVE in its Security Update Guide to document the...