CVE-2024-1580 is a medium severity (CVSS 5.9) integer overflow in the dav1d AV1 video decoder that can occur with large frame sizes and lead to memory corruption. The record recommends upgrading past dav1d 1.4.0. Apple Safari and iPadOS are also listed, so apply the related platform updates.
What's affected
The record lists the VideoLAN dav1d library, with Apple Safari and iPadOS as products that bundle or use it. The description says "We recommend upgrading past version 1.4.0 of dav1d", so treat 1.4.0 and earlier as the range to move away from.
The references are Apple's March 2024 security announcements on the Full Disclosure list. I could not retrieve them, so I cannot say which Apple builds contain the fix. Check Apple's security notes for your Safari and iPadOS version.
How to check if you're exposed
For Linux systems and build trees, look for dav1d in your package manager or inventory:
dpkg -l | grep -i dav1d
pkg-config --modversion dav1d
Media players, browsers and containers often bundle their own copy, so a package query is not always enough. A software bill of materials or a dependency scan gives a more complete answer.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- List every product that includes dav1d, directly or bundled.
- Upgrade dav1d to a release newer than 1.4.0.
- Install the latest Safari and iPadOS updates from Apple.
- Rebuild and redeploy media applications and containers that bundle the library.
- Avoid decoding video from untrusted sources on unpatched systems.
Why it matters
The record classes this as CWE-190, integer overflow or wraparound. A size calculation for a large frame wrapped around to a small number, so a buffer was too small for the data placed in it, and memory beyond it was corrupted.
Decoders handle untrusted media from the web, which makes memory safety bugs in them worth patching even when the score is moderate. The record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which dav1d version is the cutoff?
The record recommends upgrading past 1.4.0.
Why is Apple listed?
Safari and iPadOS appear in the record's product list because they ship the decoder.
Sources
- Apple advisory posting 1 (listed in the NVD record, not retrieved)
- Apple advisory posting 2 (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1580
Last reviewed: 19 October 2026.
