{"id":"CVE-2026-79113","details":"OpenAPV before 1.1.1.0 has a read_bitstream heap-based buffer overflow.","modified":"2026-10-04T07:05:09.948937Z","published":"2026-10-03T01:06:56.610Z","database_specific":{"cna_assigner":"mitre","cwe_ids":["CWE-190"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79113.json"},"references":[{"type":"WEB","url":"https://aswf.io"},{"type":"WEB","url":"https://github.com/AcademySoftwareFoundation/openapv/compare/v0.3.0.0...v1.1.1.0"},{"type":"WEB","url":"https://github.com/AcademySoftwareFoundation/openapv/tree/kp_handling_issues_20260713"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79113.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79113"},{"type":"REPORT","url":"https://github.com/AcademySoftwareFoundation/openapv/issues/219"},{"type":"FIX","url":"https://github.com/AcademySoftwareFoundation/openapv/commit/b5cc54bc786040ba3ac54020e7320e0add51e107"},{"type":"FIX","url":"https://github.com/AcademySoftwareFoundation/openapv/pull/226"},{"type":"PACKAGE","url":"https://github.com/AcademySoftwareFoundation/openapv"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/academysoftwarefoundation/openapv","events":[{"introduced":"0"},{"fixed":"9cd81ac7b99b5149580460c259bdfff73157607e"},{"fixed":"b5cc54bc786040ba3ac54020e7320e0add51e107"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.1.1.0"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v0.3.0.0","v0.2.1.3-fix","v0.2.1.3","v0.2.1.2","v0.2.1.1","v0.2.1.0","v0.2.0.4","v0.2.0.3","v0.2.0.2","v0.2.0.1","v0.2.0.0","v0.1.13.1","v0.1.13","v0.1.11.3","v0.1.12","v0.1.11.4","v0.1.11.2","v0.1.11.1","v0.1.11","v0.1.10.1","v0.1.10","v0.1.9.2","v0.1.9.1","v0.1.9","v0.1.8","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.3","v0.1.2","v0.1.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79113.json","vanir_signatures_modified":"2026-10-04T07:05:09Z","vanir_signatures":[{"target":{"function":"read_bitstream","file":"app/oapv_app_dec.c"},"deprecated":false,"digest":{"function_hash":"200311813905766225009188408312827461045","length":926},"id":"CVE-2026-79113-40f76a86","signature_type":"Function","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openapv/commit/b5cc54bc786040ba3ac54020e7320e0add51e107"},{"target":{"function":"dec_api_set_1","file":"app/oapv_app_dec.c"},"deprecated":false,"digest":{"function_hash":"127156129673415693837589819636303434839","length":7062},"id":"CVE-2026-79113-56004112","signature_type":"Function","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openapv/commit/9cd81ac7b99b5149580460c259bdfff73157607e"},{"target":{"file":"inc/oapv.h"},"deprecated":false,"digest":{"line_hashes":["3361930213154164725302441985236914405","320019860290996230793232862786023470129","180801577577608701445291681247171263082","299800276535588444533117667967318318791","77010184520619900278466393979766251849","163107632691606973360427545916768702802","339573169694854636132837141660523198295"],"threshold":0.9},"id":"CVE-2026-79113-5bab29f6","signature_type":"Line","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openapv/commit/9cd81ac7b99b5149580460c259bdfff73157607e"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["128052665509514692643892010950793685706","197584866451375341184590566265888297515","159002619768088480199792425305386724820","135771693775567287191600519801252608666"]},"id":"CVE-2026-79113-82c427ef","signature_type":"Line","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openapv/commit/b5cc54bc786040ba3ac54020e7320e0add51e107","target":{"file":"app/oapv_app_dec.c"}},{"id":"CVE-2026-79113-82e9e663","signature_type":"Line","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openapv/commit/b5cc54bc786040ba3ac54020e7320e0add51e107","target":{"file":"src/oapv.c"},"deprecated":false,"digest":{"line_hashes":["124617144229536527434557338892089702471","110372234441942571421824271305554911819","26911498791293892742391273713835770642","43360369856855627619072309139724680440","301673084877297472380752141047938831383","325195899838118696313175577667985309122","305780106260640417323124441483430300412"],"threshold":0.9}},{"source":"https://github.com/academysoftwarefoundation/openapv/commit/b5cc54bc786040ba3ac54020e7320e0add51e107","target":{"function":"oapvd_vlc_dc_coef","file":"src/oapv_vlc.c"},"deprecated":false,"digest":{"function_hash":"318289980445121756224309109799336109602","length":474},"id":"CVE-2026-79113-841cd26b","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openapv/commit/b5cc54bc786040ba3ac54020e7320e0add51e107","target":{"file":"src/oapv_vlc.c","function":"oapvd_vlc_ac_coef"},"deprecated":false,"digest":{"function_hash":"309171466451120524266930228955624115416","length":1311},"id":"CVE-2026-79113-8601c71f"},{"deprecated":false,"digest":{"function_hash":"231138427260437611643759532599840870141","length":3724},"id":"CVE-2026-79113-aced4eb7","signature_type":"Function","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openapv/commit/b5cc54bc786040ba3ac54020e7320e0add51e107","target":{"function":"dec_frm_prepare","file":"src/oapv.c"}},{"digest":{"line_hashes":["130931208455978911289872056898168714346","253625895229748046802287083472901990681","211137269060238526977130402635501993204","220038213082255168144121678472090426410","40076462814486171796902054164509527468","1848904270006178565403093611866155854","330789166566173453723045914058374592572","249755663252575364199870883607866898413","324387154224657235609831092141743839929","244899237552619785479804687140332342780","112829439944548540043189106798609300161","331798886883510799319796358109009087982","247952308511300733572401359389485744778","8632573497816251691817794619600150829","41196697069180018113025217229946529697","242767133636964664843616022194702859037","260050295521332442412929853061480753549","327626548506498583924465292565297929103","27531077878110629099155989898051030522","168730403156650694171004465276347763146","82055302169745028503120509067061695725","196648033819203059831218338229053967260","166188445281887334692076182208615086033","302975075211482029296296039105563677516","240176231698015961578539916259089041959","127652264978598558762228582339017496918","248034177837584245218866563504875050156","228005578758366203346595728712483605769","219135495736635306601111461019753501615"],"threshold":0.9},"id":"CVE-2026-79113-d6741f95","signature_type":"Line","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openapv/commit/b5cc54bc786040ba3ac54020e7320e0add51e107","target":{"file":"src/oapv_vlc.c"},"deprecated":false},{"target":{"file":"src/oapv_vlc.c","function":"dec_vlc_read"},"deprecated":false,"digest":{"length":807,"function_hash":"161602035004174589004429397720056843372"},"id":"CVE-2026-79113-fe689ca5","signature_type":"Function","signature_version":"v1","source":"https://github.com/academysoftwarefoundation/openapv/commit/b5cc54bc786040ba3ac54020e7320e0add51e107"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}]}