CVE-2024-1580 Integer overflow in VideoLAN dav1d

2024-02-1910:34:55

CWE-190

Google

github.com

cve-2024-1580

integer overflow

videolan

dav1d

av1 decoder

memory corruption

CVSS3

5.9

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

AI Score

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.

CNA Affected

[
  {
    "repo": "https://code.videolan.org/videolan/dav1d",
    "vendor": "VideoLAN",
    "product": "dav1d",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.4.0",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]