CVE catalog

CVE-2023-32570

dav1d: CVE-2023-32570

[CVE catalog]

Severity
Low · CVSS 2.5CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.74% · Oct 25, 2026

VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandav1dsid1.5.4-1fixed
Debiandav1dforky1.5.4-1fixed
Debiandav1dtrixie1.5.1-1fixed
Debiandav1dbookworm1.0.0-2+deb12u1vulnerable
Debiandav1dbookworm-security1.0.0-2+deb12u1vulnerable
Ubuntudav1d22.040.7.1-3vulnerable
Ubuntudav1d22.040.9.2-1vulnerable
Susedav1dlinux enterprise module for desktop applications 15 sp51.0.0-150500.3.3.1fixed
Susedav1dlinux enterprise module for package hub 15 sp51.0.0-150500.3.3.1fixed
Opensusedav1dleap 15.51.0.0-150500.3.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandav1dsourcesid1.2.1-2not yet assignedNot reported[1035950]
Debiandav1dsourceforky1.2.1-2not yet assignedNot reported[1035950]
Debiandav1dsourcetrixie1.2.1-2not yet assignedNot reported[1035950]
Debiandav1dsourcebookworm(unfixed)not yet assignedNot reported[1035950]
Susedav1drpmlinux enterprise module for desktop applications 15 sp51.0.0-150500.3.3.1Not reportedSUSE-SU-2023:2618-1Not reported
Susedav1drpmlinux enterprise module for package hub 15 sp51.0.0-150500.3.3.1Not reportedSUSE-SU-2023:2618-1Not reported
Opensusedav1drpmleap 15.51.0.0-150500.3.3.1Not reportedSUSE-SU-2023:2618-1Not reported

[Debian bug #1035950]

Notes

[bookworm] dav1d: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]