Reported

February 19, 2024

Issued

February 19, 2024 (last modified: April 11, 2024)

Package

libdav1d-sys (crates.io)

Type

Vulnerability

Categories

• memory-corruption

Keywords

#integer-overflow

Aliases

• GHSA-mc39-h54g-pvw6

References

• https://www.cvedetails.com/cve/CVE-2024-1580/

Patched

• >=0.7.0

Description

An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading to version 0.7.0 of libdav1d-sys, which includes dav1d 1.4.0

Advisory available under CC0-1.0 license.