diff --git a/third_party/libvpx/source/libvpx/vp9/encoder/vp9_encoder.c b/third_party/libvpx/source/libvpx/vp9/encoder/vp9_encoder.c
index 76e1a4ebe..2d4407ffa 100644
--- a/third_party/libvpx/source/libvpx/vp9/encoder/vp9_encoder.c
+++ b/third_party/libvpx/source/libvpx/vp9/encoder/vp9_encoder.c
@@ -2177,6 +2177,18 @@ void vp9_change_config(struct VP9_COMP *cpi, const VP9EncoderConfig *oxcf) {
     update_frame_size(cpi);
 
   if (last_w != cpi->oxcf.width || last_h != cpi->oxcf.height) {
+    // These buffers are sized by mi_stride/mi_rows and lazily allocated only
+    // when NULL in set_rt_speed_feature_framesize_independent(). Free them
+    // here so they are re-created at the new size on the next frame; otherwise
+    // a dimension-growing config_set leaves a stale undersized buffer that is
+    // indexed with new-frame SB offsets (heap OOB in avg_source_sad()).
+    vpx_free(cpi->content_state_sb_fd);
+    cpi->content_state_sb_fd = NULL;
+    vpx_free(cpi->count_arf_frame_usage);
+    cpi->count_arf_frame_usage = NULL;
+    vpx_free(cpi->count_lastgolden_frame_usage);
+    cpi->count_lastgolden_frame_usage = NULL;
+
     vpx_free(cpi->consec_zero_mv);
     CHECK_MEM_ERROR(
         &cm->error, cpi->consec_zero_mv,