A vendored copy is a copy of a software library stored directly in a product’s source code or distribution, rather than obtained as a separate package from an external repository. Developers may vendor code to control changes, support builds without network access, or modify the library for their needs.
Vendoring can make vulnerability management harder: updating the upstream package manager may not update the embedded code. Defenders should identify bundled components, compare their versions with security advisories, and check whether the product vendor has released an update. In attacks involving a vulnerable decoder, exposure depends not just on whether the library is present, but also on whether the affected vendored version is used to process untrusted input.