{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.8.0"}],"component":"avif","cve_ids":["CVE-2020-36407"],"ecosystem":"PyPI","epss":0.01413,"exploited":false,"fixed_versions":[],"id":"tcs_01M5KGFTH04TS8S3057X31A750","modified_at":"2026-07-13T07:15:15.718824355Z","published_at":"2021-07-01T03:15:08.033Z","references":["https://osv.dev/vulnerability/PYSEC-2021-892","https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libavif/OSV-2020-1597.yaml","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24811","https://github.com/AOMediaCodec/libavif/commit/0a8e7244d494ae98e9756355dfbfb6697ded2ff9"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"PYSEC-2021-892","url":"https://osv.dev/vulnerability/PYSEC-2021-892"}],"summary":"libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid."}