CVE-2024-1580: apple ipados Integer Overflow or Wraparound
CVSS: 8.8v3.1HighModified
AliasesALPINE-CVE-2024-1580MGASA-2024-0111SUSE-SU-2024:0963-1SUSE-SU-2024:0964-1UBUNTU-CVE-2024-1580DEBIAN-CVE-2024-1580DSA-5686-1
Published 19-02-2024Last modified 13-02-2025
Vulnerability summary
CVE-2024-1580 is a high (CVSS 8.8) Integer Overflow or Wraparound vulnerability in apple ipados. EPSS estimates a 1.84% chance of exploitation in the next 30 days, higher than 78.7% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
1.84%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 19-02-2024PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSources5 sources · 5.9–8.8
- CVE.orgCNA5.9MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:LDiffers
- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.84%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
0.00 pp
From 1.84% on 21-09-2026
21-09-202621-10-2026
EPSS score1.84%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apple5 products
Suse3 products
- dav1d&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5< 0.9.2-150400.3.3.1
- dav1d&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP5< 1.0.0-150500.3.6.1
- dav1d&distro=SUSE Linux Enterprise Module for Package Hub 15 SP5< 1.0.0-150500.3.6.1
Alpine1 product
- dav1d< 1.3.0-r1
Debian1 product
- dav1d< 1.4.0-1 | < 0.7.1-3+deb11u1 | < 1.0.0-2+deb12u1
Fedoraproject1 product
- fedoraEOL40
Mageia1 product
- dav1d< 1.2.1-1.1.mga9
Opensuse1 product
- dav1d&distro=openSUSE Leap 15.5< 1.0.0-150500.3.6.1
Ubuntu1 product
- dav1dAll versions (No fix recorded)
Videolan1 product
- dav1d< 1.4.0
9 vendors · 15 products
References
26 links- lists.fedoraproject.org/archives/…Mailing List
- support.apple.com/kb/HT214098Third Party Advisory
- support.apple.com/kb/HT214097Third Party Advisory
- support.apple.com/kb/HT214095Third Party Advisory
- support.apple.com/kb/HT214093Third Party Advisory
- support.apple.com/kb/HT214096Third Party Advisory
- support.apple.com/kb/HT214094Third Party Advisory
- seclists.org/fulldisclosure/2024/Mar/41Mailing List
Show all 26 references
- seclists.org/fulldisclosure/2024/Mar/36Mailing List
- seclists.org/fulldisclosure/2024/Mar/38Mailing List
- seclists.org/fulldisclosure/2024/Mar/37Mailing List
- seclists.org/fulldisclosure/2024/Mar/40Mailing List
- seclists.org/fulldisclosure/2024/Mar/39Mailing List
