Security readout for executives and security teams
Plain-English summary
CVE-2021-30474 is a use-after-free flaw in libaom before March 30, 2021. The provided sources do not include a CVSS score or active exploitation evidence. Business urgency depends on whether your systems use vulnerable aom/libaom packages, especially in media-processing paths.
Executive priority
Prioritize as dependency remediation, not emergency response, unless libaom is used in exposed media-processing workflows. The missing severity score and no cited exploitation reduce certainty, but stale codec libraries still carry operational risk.
Technical view
The issue is in aom_dsp/grain_table.c in AOMedia libaom before 2021-03-30. The source bundle points to an upstream fix commit and later Debian and Gentoo security advisories, but does not provide affected version ranges, CWE mapping, or exploit details.
Likely exposure
Exposure is most likely where servers, desktops, containers, or bundled applications use vulnerable aom/libaom builds. The provided affected-product data is incomplete, so inventory and package-level verification are required.
Exploitation context
CISA KEV status is false, and the provided sources do not state active exploitation. Use-after-free issues may cause crashes or memory-corruption risk, but the bundle does not establish practical exploitability or exploitation in the wild.
Researcher notes
Evidence is sparse: the CVE description names only the file, project, and pre-2021-03-30 condition. Distribution advisories confirm downstream security updates. Avoid asserting affected versions, exploitability, or impact beyond use-after-free without vendor-specific evidence.
Mitigation direction
- Apply Debian or Gentoo aom security updates where those distributions are used.
- Update libaom to a build containing the upstream March 30, 2021 fix.
- Check application vendors for bundled libaom update guidance.
- Rebuild or redeploy containers that include vulnerable aom/libaom packages.
Validation and detection
- Inventory hosts, containers, and applications for aom or libaom packages.
- Compare installed versions against Debian DSA-5490, DLA-3556-1, or Gentoo GLSA-202401-32.
- Confirm the upstream fix commit is present in locally built libaom.
- Verify patched media-processing services were restarted or redeployed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-30474 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugs.chromium.org/p/aomedia/issues/detail?id=3000CVE reference
- https://aomedia.googlesource.com/aom/+/6e31957b6dc62dbc7d1bb70cd84902dd14c4bf2eCVE reference
- [debian-lts-announce] 20230905 [SECURITY] [DLA 3556-1] aom security updateCVE reference · mailing-list
- DSA-5490CVE reference · vendor-advisory
- GLSA-202401-32CVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.