CVE-2023-32570

VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application...

5.9 MediumFix available

VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.75%Up 0.7 points since May 10, 2023

What each source reports

NVD Score used 5.9

VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.

Record: CVE-2023-32570
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-362
Updated: 2026-11-02

CVE List 5.9

VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.

Record: CVE-2023-32570
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-362
Updated: 2026-11-02

EUVDEUVD-2023-36814 5.9

VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.

Record: EUVD-2023-36814
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6q7w-3rwf-fh47 5.9

VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application...

VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.

Record: GHSA-6q7w-3rwf-fh47
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-362
Updated: 2026-11-02

OSVBELL-CVE-2023-32570 5.9

Record: BELL-CVE-2023-32570
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 5.9

VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.

Record: CVE-2023-32570
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVDEBIAN-CVE-2023-32570 5.9

VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.

Record: DEBIAN-CVE-2023-32570
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2023-32570 5.9

CVE-2023-32570 in dav1d - Patched by Root

Root has patched CVE-2023-32570 in the dav1d package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2023-32570
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-32570 5.9

VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.

Record: UBUNTU-CVE-2023-32570
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2024:13730-1 No score

dav1d-1.4.0-3.1 on GA media

These are all security issues fixed in the dav1d-1.4.0-3.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13730-1
Updated: 2026-11-02

OSVSUSE-SU-2023:2618-1 No score

Security update for dav1d

This update for dav1d fixes the following issues:

CVE-2023-32570: Fixed possible crash when decoding a frame (bsc#1211262).

Record: SUSE-SU-2023:2618-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`dav1d` Alpaquita:stream	1.0.0-r2 up to 1.2.1-r0	1.2.1-r0
`dav1d` BellSoft Hardened Containers:stream	1.0.0-r2 up to 1.2.1-r0	1.2.1-r0
`dav1d` Debian:12	All versions, plus listed versions 1.0.0-21.0.0-2+deb12u11.1.0-11.2.0-11.2.1-1 Show 12 moreShow less 1.2.1-21.3.0-11.3.0-21.4.0-11.4.1-11.4.2-11.4.3-11.5.0-11.5.1-11.5.2-11.5.3-11.5.4-1	None known
`dav1d` Debian:13	before 1.2.1-2	1.2.1-2
`dav1d` Debian:14	before 1.2.1-2	1.2.1-2
`dav1d` Root:Debian:12	before 1.0.0-2+deb12u1.root.io.2	1.0.0-2+deb12u1.root.io.21.0.0-2+deb12u1.root.io.31.0.0-2+deb12u1.root.io.41.0.0-2+deb12u1.root.io.11.0.0-2+deb12u1.aikido.5
`rootio-dav1d` Root:Debian:12	before 1.0.0-2+deb12u1.root.io.2	1.0.0-2+deb12u1.root.io.21.0.0-2+deb12u1.root.io.31.0.0-2+deb12u1.root.io.41.0.0-2+deb12u1.root.io.11.0.0-2+deb12u1.aikido.5
`dav1d` SUSE:Linux Enterprise Module for Desktop Applications 15 SP5	before 1.0.0-150500.3.3.1	1.0.0-150500.3.3.1
`dav1d` SUSE:Linux Enterprise Module for Package Hub 15 SP5	before 1.0.0-150500.3.3.1	1.0.0-150500.3.3.1
`dav1d` openSUSE:Leap 15.5	before 1.0.0-150500.3.3.1	1.0.0-150500.3.3.1
`dav1d` Ubuntu:22.04:LTS	All versions, plus listed versions 0.7.1-30.9.2-1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-32570 is a medium vulnerability (CVSS 5.9) in Videolan Dav1d, published May 10, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in dav1d 1.2.1-r0.

References

Show 10 moreShow less