CVE-2024-1580

HIGH 8.8CVE-2024-1580 · Published 19/02/2024 · updated 17/06/2026

In short

CVE-2024-1580 is a HIGH (CVSS 8.8) vulnerability affecting safari (apple), dav1d (videolan).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.9% of all vulnerabilities.
Fix: update to 17.4.1, 1.4.0 or later.

Package	Affected versions	Patched versions
safari apple	`< 17.4.1`	`17.4.1`
dav1d videolan	`< 1.4.0`	`1.4.0`

Description

An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.

References

seclists.org/fulldisclosure/2024/Mar/36 · Mailing List
seclists.org/fulldisclosure/2024/Mar/37 · Mailing List
seclists.org/fulldisclosure/2024/Mar/38 · Mailing List
seclists.org/fulldisclosure/2024/Mar/39 · Mailing List
seclists.org/fulldisclosure/2024/Mar/40 · Mailing List
seclists.org/fulldisclosure/2024/Mar/41 · Mailing List
code.videolan.org/videolan/dav1d/-/blob/master/NEWS · Release Notes
code.videolan.org/videolan/dav1d/-/releases/1.4.0 · Release Notes
lists.fedoraproject.org/archives/list/[email protected]/message/5EPMUNDMEBGESOJ2ZNCWYEAYOOEKNWOO · Mailing List
support.apple.com/kb/HT214093 · Third Party Advisory
support.apple.com/kb/HT214094 · Third Party Advisory

More vulnerabilities in safari

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

safari

apple

< 17.4.1

17.4.1

dav1d

videolan

< 1.4.0

1.4.0

More vulnerabilities in safari

See all →