CVE-2024-1580 Integer overflow in VideoLAN dav1d

2024-02-1910:34:55

CWE-190

Google

www.cve.org

integer overflow

videolan

dav1d

av1

memory corruption

upgrade

CVSS3

5.9

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

17.1%

JSON

An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "dav1d",
    "repo": "https://code.videolan.org/videolan/dav1d",
    "vendor": "VideoLAN",
    "versions": [
      {
        "lessThan": "1.4.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]