GHSA-3p7f-4r2q-wxmm

GHSA-3p7f-4r2q-wxmm PUBLISHED CVSS 5.900000095367432 MEDIUM

Record from GitHub Advisory Database · Published February 19, 2024

An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.

Risk scores

CVSS 3.1

5.900000095367432

CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

Timeline

Feb 19, 2024 CVE Published
Apr 10, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-3p7f-4r2q-wxmm
vulnetix vdb fixes GHSA-3p7f-4r2q-wxmm

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-3p7f-4r2q-wxmm/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

https://support.apple.com/kb/HT214093 url
https://support.apple.com/kb/HT214094 url
https://support.apple.com/kb/HT214095 url
https://support.apple.com/kb/HT214098 url
http://seclists.org/fulldisclosure/2024/Mar/37 url
http://seclists.org/fulldisclosure/2024/Mar/39 url
http://seclists.org/fulldisclosure/2024/Mar/40 url
http://seclists.org/fulldisclosure/2024/Mar/41 url
https://nvd.nist.gov/vuln/detail/CVE-2024-1580 advisory
https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS url
https://code.videolan.org/videolan/dav1d/-/releases/1.4.0 url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO url
https://support.apple.com/kb/HT214096 url
https://support.apple.com/kb/HT214097 url
http://seclists.org/fulldisclosure/2024/Mar/36 url
http://seclists.org/fulldisclosure/2024/Mar/38 url

Look up in the Resolve Platform →