Integer overflow in VideoLAN dav1d
Priority MEDIUM 42CWE-190Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.
Summary
An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01835 79th percentileScored 2026-11-07
Fix Fixed dav1d (VideoLAN): 1.4.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VideoLAN | dav1d | before 1.4.0 | 1.4.0 | Patch available | CNA |
- dav1d VendorVideoLAN Affected before 1.4.0 Fixed in 1.4.0 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:videolan:dav1d:*:*:*:*:*:*:*:* | before 1.4.0 | Vulnerable | VideoLAN |
| cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* | before 17.4.1 | Vulnerable | Apple |
| cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* | before 16.7.7; 17.0 to before 17.4.1 | Vulnerable | Apple |
| cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | before 16.7.7; 17.0 to before 17.4.1 | Vulnerable | Apple |
| cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* | 13.0 to before 13.6.6; 14.0 to before 14.4.1 | Vulnerable | Apple |
| cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* | before 1.1.1 | Vulnerable | Apple |
| cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* | 40 | Vulnerable | Fedoraproject |
- cpe:2.3:a:videolan:dav1d:*:*:*:*:*:*:*:* Versions before 1.4.0 Vulnerable ·VideoLAN
- cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* Versions before 17.4.1 Vulnerable ·Apple
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* Versions before 16.7.7; 17.0 to before 17.4.1 Vulnerable ·Apple
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* Versions before 16.7.7; 17.0 to before 17.4.1 Vulnerable ·Apple
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions 13.0 to before 13.6.6; 14.0 to before 14.4.1 Vulnerable ·Apple
- cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* Versions before 1.1.1 Vulnerable ·Apple
- cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* Versions 40 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA dav1d (VideoLAN) Fixed in 1.4.0
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2024-1580
- 2026-10-03 Alias added: GHSA-3p7f-4r2q-wxmm
References
Advisory 6
Other 9
- https://code.videolan.org/videolan/dav1d/-/releases/1.4.0
- https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS
- https://lists.fedoraproject.org/archives/list/[email protected]/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO/
- http://seclists.org/fulldisclosure/2024/Mar/41
- http://seclists.org/fulldisclosure/2024/Mar/36
- http://seclists.org/fulldisclosure/2024/Mar/38
- http://seclists.org/fulldisclosure/2024/Mar/37
- http://seclists.org/fulldisclosure/2024/Mar/40
- http://seclists.org/fulldisclosure/2024/Mar/39
More VideoLAN Dav1d vulnerabilities
- TI-2023-15852 VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an… CVSS 3.1MEDIUM 5.9
Sources
- CVE-2024-1580 · CVE Program
- CVE-2024-1580 · NVD
- FIRST EPSS
- GHSA-3p7f-4r2q-wxmm · GitHub Advisory Database · CC BY 4.0
- CVE-2024-1580 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences