Effective Fuzzing: A Dav1d Case Study
Summary: While working on a 20% project with Project Zero, Nick Galloway found a signed 32-bit integer overflow in the dav1d AV1 decoder that occurs when multiple decoding threads are used and leads to an out-of-bounds write to memory. Dav1d 1.4.0 patched the flaw, assigned CVE-2024-1580, which had gone undetected by oss-fuzz because the fuzzer set a 4096*4096 frame_size_limit that 64-bit dav1d builds do not apply by default.
Bottom line: The bug sat in code already fuzzed at scale, missed only because oss-fuzz caps memory at 2.5GB and the fuzzer's artificial frame-size limit kept it out of reach - and a parsing flaw in AV1 decoders can enable remote code execution, potentially a 0-click exploit in messaging clients.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-1580
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026