CVE-2018-6406

CVE-2018-6406 describes a heap-based buffer over-read and potential out-of-bounds write vulnerability in the ParseVP9SuperFrameIndex function of libwebm through 2018-01-30. This flaw, stemming from a lack of validation for child_frame_length data in .webm files, allows remote attackers to trigger information leaks, denial of service, or other unspecified impacts. With a CVSS score of 8.8 (High), it can be exploited over a network with low attack complexity, requiring user interaction. Despite its high severity, there is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.