Security readout for executives and security teams
Plain-English summary
CVE-2021-30475 is a buffer overflow in libaom, the AOMedia AV1 codec library, in code present before March 24, 2021. Organizations are mainly exposed where vulnerable aom/libaom packages remain installed. The source bundle does not provide CVSS, CWE, or active exploitation evidence.
Executive priority
Treat this as a maintenance-priority media library vulnerability unless exposure involves untrusted media processing at scale. Patch through normal security update channels, with higher urgency for internet-facing or automated media-processing workflows.
Technical view
The flaw is in aom_dsp/noise_model.c in libaom before the March 24, 2021 AOMedia fix commit. Fedora, Debian, and Gentoo later issued aom security updates. The bundle does not describe exploit primitives, affected version ranges beyond the date boundary, or runtime impact details.
Likely exposure
Exposure is most likely on Linux systems, applications, or build images using vulnerable aom/libaom packages for AV1 media handling. Risk depends on whether untrusted media reaches the vulnerable library. The bundle lists distro advisories but does not enumerate application-level products.
Exploitation context
CISA KEV status is false, and the provided sources do not claim active exploitation. Public issue, fix commit, and vendor advisories exist, so defenders should treat this as a known library flaw, not as confirmed exploited in the wild.
Researcher notes
Evidence is sparse: no CVSS, CWE, exploit status, or detailed impact text is included. The strongest anchors are the CVE description, the AOMedia fix commit, and downstream distro advisories confirming security updates for aom/libaom.
Mitigation direction
- Update aom/libaom using current vendor security packages.
- Ensure libaom contains the March 24, 2021 fix or later.
- Prioritize systems that process untrusted AV1 or media content.
- Check Fedora, Debian, Gentoo, or vendor guidance for package-specific fixes.
Validation and detection
- Inventory installed aom/libaom packages and linked applications.
- Compare package versions against vendor security advisories.
- Review SBOMs and container images for bundled libaom copies.
- Confirm patched builds include the referenced AOMedia fix commit.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-30475 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugs.chromium.org/p/aomedia/issues/detail?id=2999CVE reference
- https://aomedia.googlesource.com/aom/+/12adc723acf02633595a4d8da8345742729f46c0CVE reference
- FEDORA-2021-1c3f7963a5CVE reference · vendor-advisory
- [debian-lts-announce] 20230905 [SECURITY] [DLA 3556-1] aom security updateCVE reference · mailing-list
- DSA-5490CVE reference · vendor-advisory
- GLSA-202401-32CVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.