CVE-2025-48592 AI-generated analysis

platform/frameworks/av, media/codec2 software dav1d (AV1) decoder plugin

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (7 corrections). Verify against the commit before relying on it.

The Codec2 software AV1 decoder plugin (C2SoftDav1dDec) now sets Dav1dSettings.all_layers = 0 before dav1d_open, so dav1d outputs only one layer for SVC streams instead of all layers, which the plugin was not designed to handle.

Root cause

C2SoftDav1dDec::initDecoder() in media/codec2/components/dav1d/C2SoftDav1dDec.cpp used dav1d_default_settings() unchanged except for n_threads and max_frame_delay. Per the commit message, dav1d by default outputs all layers for SVC clips, and the plugin is not designed to handle that. The material does not show the exact downstream fault. The bulletin rates it High / ID.

How the fix works

• media/codec2/components/dav1d/C2SoftDav1dDec.cpp:C2SoftDav1dDec::initDecoder(): adds `lib_settings.all_layers = 0;` right after `dav1d_default_settings(&lib_settings);` and before dav1d_open(), so the dav1d context is created with single-layer output for SVC streams.
• This is a single one-line commit. The plugin's output and picture handling path is not changed. The fix removes the trigger at the library-configuration level instead of making the plugin robust to multi-layer output.

Completeness

• In the code shown, initDecoder() is where Dav1dSettings is built and dav1d_open() is called, so contexts created there get the new setting.
• The fix adds no handling in the plugin for multi-layer output. It relies on dav1d honoring all_layers = 0. The material does not show whether any other code path could re-enable all_layers or create a context elsewhere.
• Only the dav1d plugin is touched. The material does not show whether other AV1 decoder components have an analogous issue.

Behavior changes

• For AV1 SVC streams decoded through C2SoftDav1dDec, dav1d now outputs only one layer instead of all layers (per the commit message).
• No new error codes, API changes or validation failures are introduced by the diff.

Per major

• Android 14: not affected: the bulletin does not list Android 14, and media/codec2/components/dav1d/C2SoftDav1dDec.cpp does not exist at android-security-14.0.0_r29.
• Android 15: same fix: platform/frameworks/av 9d74d91a39f3 in android-security-15.0.0_r12 (one-line all_layers = 0). 4/4 lines of the patched region are present at android-security-15.0.0_r17.
• Android 16: same fix: platform/frameworks/av 8febdebcb5e8 in android-security-16.0.0_r3, an identical diff at a shifted line offset. 4/4 lines are present at android-security-16.0.0_r8.
• Android 17: not affected: the bulletin does not list Android 17. The patched region (including all_layers = 0) is already present at android-security-17.0.0_r1.

Unknowns

• The exact fault in the plugin's output path when multiple layer pictures are delivered is not shown. The only evidence is the commit message's statement that the plugin is not designed for it.
• Whether the second bug (427113482) refers to a distinct symptom of the same configuration issue.
• Whether other AV1 decoder components have a comparable SVC handling issue.
• Which callers invoke C2SoftDav1dDec::initDecoder() and when (the index results are unrelated components).

Back to December 2025 · Findings