How AOMedia Tracks and Fixes AVIF Vulnerabilities

The Alliance for Open Media (AOMedia) tracks and resolves security vulnerabilities in the AV1 Image File Format (AVIF) through coordinated vulnerability disclosure, rigorous automated testing, and transparent patch management across its reference implementations. Because AVIF is both an open standard and a collection of open-source software libraries, AOMedia separates the remediation of abstract specification flaws from concrete memory safety and parsing bugs found in codebases like libavif. By leveraging private tracking channels, fuzz testing integration, and standard Common Vulnerabilities and Exposures (CVE) reporting, the consortium ensures that security flaws are patched and distributed to downstream vendors before public disclosure.

Vulnerability Reporting and Intake

Security researchers and developers report potential vulnerabilities primarily through coordinated disclosure channels established in AOMedia’s open-source repositories, notably hosted on GitHub. For core reference projects like libavif and the underlying libaom codec, reporters use private vulnerability reporting via GitHub Security Advisories (GHSA) or direct contact with designated security maintainers. This private intake prevents premature public exposure of zero-day vulnerabilities affecting image decoders, which are historically high-risk attack surfaces in web browsers and operating systems.

Continuous Testing and Proactive Discovery

Before vulnerabilities are reported externally, AOMedia relies heavily on automated, proactive discovery mechanisms:

• OSS-Fuzz Integration: The reference libraries (libavif and libaom) are integrated into Google’s OSS-Fuzz service. Continuous fuzzing subjects the parser and decoding pipelines to millions of malformed and edge-case AVIF payloads to detect memory corruption, buffer overflows, and integer overflows.
• Static Analysis and Sanitizers: Continuous integration workflows enforce AddressSanitizer (ASan), UndefinedBehaviorSanitizer (UBSan), and MemorySanitizer (MSan) to catch undefined behaviors and memory leaks during regular development.

Triage and Patch Development

Once a valid security issue is submitted or detected:

1. Verification: Maintainers verify the report by reproducing the issue against the current main branch and active release tags.
2. Private Remediation: Discussions, pull requests, and code reviews take place within a private security advisory branch to maintain confidentiality.
3. Specification Assessment: The AOMedia working group determines if the vulnerability is strictly an implementation bug (such as an unchecked boundary in C) or an ambiguity in the AVIF/ISOBMFF specification itself. If the specification permits unsafe behavior, the working group drafts an amendment or clarification to the standard.

CVE Assignment and Coordinated Disclosure

AOMedia coordinates with authorized Common Vulnerabilities and Exposures (CVE) Numbering Authorities (CNAs)—often via GitHub or participating member organizations such as Google—to assign CVE identifiers to confirmed vulnerabilities. A coordinated release date is established, allowing sufficient time for high-impact downstream consumers (such as Google Chrome, Mozilla Firefox, Android, and Linux distributions) to ingest the patch before details are published.

Release and Ecosystem Deployment

The resolution phase concludes with the publication of a point release containing the fix. The release notes detail the security patch, credit the reporting researcher, and link the advisory to the assigned CVE. Simultaneously, the private GitHub Security Advisory is converted into a public notice, alerting developers across the broader web ecosystem to update their AVIF parsing dependencies.