CVE-2024-1580

What it actually does

Integer overflow in AV1 decoder when processing videos with large frame sizes leads to memory corruption.

Why it matters to the business

Applications handling untrusted video content risk crashes or unauthorized code execution, increasing operational downtime and potential data exposure especially in media processing pipelines.

How an attack unfolds

An attacker crafts a malicious AV1 video stream containing oversized frame dimensions and delivers it to a vulnerable decoder instance, triggering the overflow during decoding to corrupt memory and potentially gain control.

How to fix it

Upgrade dav1d past version 1.4.0. For gnutls/gnutls (GIT) update to commit 0dec774d17f4855583aa8da66772f2245a59e440.

How to confirm the fix worked

Confirm decoder version exceeds 1.4.0 or gnutls commit matches the fixed hash, then test with sample large-frame AV1 content for absence of corruption.

Typical attack path

1. Identify target application using vulnerable AV1 decoding
2. Craft AV1 video payload with large frame size to trigger integer overflow
3. Deliver payload via network, file share, or media upload
4. Trigger decoding to cause memory corruption and attempt code execution

How to detect it

Review application logs for decoder crashes during AV1 video processing and monitor for unusual memory access patterns around video decode routines.

What your security team should do

• Prioritize upgrade of dav1d and dependent gnutls packages to fixed versions within 30 days
• Scan media processing workloads for vulnerable decoder versions
• Implement input validation or sandboxing for untrusted video streams until patched