CVE-2025-5283

This vulnerability marked as Important rather than Moderate due to the nature of the flaw, a double-free in vpx_codec_enc_init_multi, which can lead to heap memory corruption. Double-free issues compromise memory integrity and are often a precursor to use-after-free or arbitrary code execution vulnerabilities, particularly in applications written in C/C++ that lack memory safety guarantees. In this case, the vulnerability occurs during encoder initialization for WebRTC, a high-frequency, remotely triggerable code path in browsers like Firefox. Because the failure happens after a failed allocation, it exposes a non-trivial edge case in error handling, which can be difficult to audit and reliably mitigate. The risk is elevated by the fact that WebRTC handles untrusted input from remote peers, making the flaw remotely exploitable in real-world scenarios.