GHSA-mc39-h54g-pvw6
libdav1d-sys affected by dav1d AV1 decoder integer overflow
An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading to version 0.7.0 of libdav1d-sys, which includes dav1d 1.4.0.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
What each source reports
GitHub Advisories Score used
libdav1d-sys affected by dav1d AV1 decoder integer overflow
An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading to version 0.7.0 of libdav1d-sys, which includes dav1d 1.4.0.
- Record
GHSA-mc39-h54g-pvw6- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
libdav1d-sys affected by dav1d AV1 decoder integer overflow
An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading to version 0.7.0 of libdav1d-sys, which includes dav1d 1.4.0.
- Record
GHSA-mc39-h54g-pvw6- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVRUSTSEC-2024-0016No score
dav1d AV1 decoder integer overflow
An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading to version 0.7.0 of libdav1d-sys, which includes dav1d 1.4.0
- Record
RUSTSEC-2024-0016- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libdav1d-syscrates.io | before 0.7.0 | 0.7.0 |
libdav1d-syscrates.io | 0.0.0-0 up to 0.7.0 | 0.7.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-mc39-h54g-pvw6 is a medium vulnerability (CVSS 5.9) in libdav1d-sys, published February 19, 2024. No source lists public exploit code. Fixed in libdav1d-sys 0.7.0.