{"id":"CVE-2023-32570","aliases":["BELL-CVE-2023-32570","DEBIAN-CVE-2023-32570","EUVD-2023-36814","GHSA-6q7w-3rwf-fh47","ROOT-OS-DEBIAN-12-CVE-2023-32570","SUSE-SU-2023:2618-1","UBUNTU-CVE-2023-32570","openSUSE-SU-2024:13730-1"],"status":"published","title":"VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application...","description":"VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0075,"percentile":0.55397,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2023-05-10T00:00:00Z","modified":"2026-10-26T18:02:29Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"dav1d","fixed_in":["1.2.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"dav1d","fixed_in":["1.2.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dav1d","fixed_in":["1.2.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dav1d","fixed_in":["1.2.1-2"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"dav1d","fixed_in":["1.0.0-2+deb12u1.root.io.2","1.0.0-2+deb12u1.root.io.3","1.0.0-2+deb12u1.root.io.4","1.0.0-2+deb12u1.root.io.1","1.0.0-2+deb12u1.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-dav1d","fixed_in":["1.0.0-2+deb12u1.root.io.2","1.0.0-2+deb12u1.root.io.3","1.0.0-2+deb12u1.root.io.4","1.0.0-2+deb12u1.root.io.1","1.0.0-2+deb12u1.aikido.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"dav1d","fixed_in":["1.0.0-150500.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"dav1d","fixed_in":["1.0.0-150500.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"dav1d","fixed_in":["1.0.0-150500.3.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"dav1d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-r2"},{"fixed":"1.2.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"dav1d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-r2"},{"fixed":"1.2.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dav1d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0-2","1.0.0-2+deb12u1","1.1.0-1","1.2.0-1","1.2.1-1","1.2.1-2","1.3.0-1","1.3.0-2","1.4.0-1","1.4.1-1","1.4.2-1","1.4.3-1","1.5.0-1","1.5.1-1","1.5.2-1","1.5.3-1","1.5.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"dav1d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dav1d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-2"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"dav1d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-2+deb12u1.root.io.2"},{"fixed":"1.0.0-2+deb12u1.root.io.3"},{"fixed":"1.0.0-2+deb12u1.root.io.4"},{"fixed":"1.0.0-2+deb12u1.root.io.1"},{"fixed":"1.0.0-2+deb12u1.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-dav1d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-2+deb12u1.root.io.2"},{"fixed":"1.0.0-2+deb12u1.root.io.3"},{"fixed":"1.0.0-2+deb12u1.root.io.4"},{"fixed":"1.0.0-2+deb12u1.root.io.1"},{"fixed":"1.0.0-2+deb12u1.aikido.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"dav1d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150500.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"dav1d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150500.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"dav1d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-150500.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dav1d","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.1-3","0.9.2-1"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"videolan","product":"dav1d"}],"references":[{"url":"https://code.videolan.org/videolan/dav1d/-/commit/cf617fdae0b9bfabd27282854c8e81450d955efa","tags":["x_transferred","Patch","fix"]},{"url":"https://code.videolan.org/videolan/dav1d/-/tags/1.2.0","tags":["x_transferred","Release Notes","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LXZ6CUNJFDJLCFOZHY2TIGMCAEITLCRP/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WGSO7UMOF4MVLQ5H6KIV7OG6ONS377B/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202310-05","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32570"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WGSO7UMOF4MVLQ5H6KIV7OG6ONS377B"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LXZ6CUNJFDJLCFOZHY2TIGMCAEITLCRP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WGSO7UMOF4MVLQ5H6KIV7OG6ONS377B"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LXZ6CUNJFDJLCFOZHY2TIGMCAEITLCRP"},{"url":"https://github.com/advisories/GHSA-6q7w-3rwf-fh47"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-32570","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-32570","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232618-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1211262","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32570","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-32570","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32570","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-32570","description":"VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.","status":"published","published":"2023-05-10T00:00:00Z","modified":"2025-01-28T15:42:41.962Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:35:29.381004Z"}],"euvd":[{"id":"EUVD-2023-36814","description":"VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.","status":"published","published":"2023-05-10T00:00:00Z","modified":"2025-01-28T15:42:41Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:04:11.814906Z"}],"ghsa":[{"id":"GHSA-6q7w-3rwf-fh47","title":"VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application...","description":"VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.","status":"published","published":"2023-05-10T06:30:28Z","modified":"2025-01-28T18:32:22Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:59:42.234766Z"}],"nvd":[{"id":"CVE-2023-32570","description":"VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.","status":"published","published":"2023-05-10T05:15:12.19Z","modified":"2026-06-17T05:59:08.593Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:08:01.131774Z"}],"osv":[{"id":"BELL-CVE-2023-32570","status":"published","published":"2023-05-10T05:15:00Z","modified":"2026-09-06T07:15:23.766241825Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-32570","description":"VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.","status":"published","published":"2023-05-10T05:15:12.19Z","modified":"2026-03-15T14:50:01.903482Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:32.116263Z"},{"id":"DEBIAN-CVE-2023-32570","description":"VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.","status":"published","published":"2023-05-10T05:15:12.19Z","modified":"2026-10-26T18:02:29.469381584Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2023-32570","title":"CVE-2023-32570 in dav1d - Patched by Root","description":"Root has patched CVE-2023-32570 in the dav1d package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T08:49:08Z","modified":"2026-08-26T01:10:12.715259152Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"UBUNTU-CVE-2023-32570","description":"VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.","status":"published","published":"2023-05-10T05:15:00Z","modified":"2026-04-22T14:06:40.691653Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"openSUSE-SU-2024:13730-1","title":"dav1d-1.4.0-3.1 on GA media","description":"These are all security issues fixed in the dav1d-1.4.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:13:41.217269Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2023:2618-1","title":"Security update for dav1d","description":"This update for dav1d fixes the following issues:\n\n- CVE-2023-32570: Fixed possible crash when decoding a frame (bsc#1211262).\n","status":"published","published":"2023-06-23T11:40:52Z","modified":"2026-02-04T02:56:11.891004Z","updated_at":"2026-11-02T15:53:53.019382Z"}]}}