Gstreamer
CVE-2009-0586
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS v2 score of 7.5 with vector AV:N/AC:L/Au:N/C:P/I:P/A:P indicates this is a remotely exploitable vulnerability requiring no authentication and low attack complexity, affecting confidentiality, integrity, and availability. The EPSS score of 2.82% places it in the 86th percentile, suggesting higher-than-average exploitation likelihood compared to other CVEs. While not listed in CISA KEV, multiple public exploit references and patches indicate this was actively researched. The combination of remote code execution capability, low complexity, and the widespread use of GStreamer in media applications makes this a high-priority issue for systems still running vulnerable versions, though its age (2009) likely limits current real-world impact to legacy deployments. |
| Exploit ScenarioDerived | An attacker creates a malicious Ogg Vorbis audio file containing an oversized base64-encoded COVERART tag designed to trigger the integer overflow when processed by vulnerable GStreamer applications. When a user opens this file in any GStreamer-based media player or streaming service, the overflow corrupts the heap and allows the attacker to execute arbitrary code with the privileges of the media application. Public patches and exploit discussions at SecurityFocus (BID 34100) confirm that proof-of-concept exploits were developed, making this a practical attack vector against unpatched systems processing untrusted media files. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A critical integer overflow vulnerability exists in GStreamer's gst-plugins-base package before version 0.10.23, allowing remote attackers to execute arbitrary code through specially crafted COVERART tags in Vorbis audio files. The vulnerability triggers when base64-encoded cover art data causes an integer overflow during memory allocation, leading to a heap buffer overflow with full code execution potential. With an EPSS score of 2.82% (86th percentile) and patches available since 2009, this represents a high-severity but dated vulnerability that may still affect legacy systems.
RemediationAI
Upgrade gst-plugins-base to version 0.10.23 or later immediately, as patches have been available since March 2009 via the official GStreamer repository at http://cgit.freedesktop.org/gstreamer/gst-plugins-base/commit/?id=566583e87147f774e7fc4c78b5f7e61d427e40a9. For distribution-specific updates, Ubuntu users should apply USN-735-1, while other distributions should refer to their respective security advisories linked in the references. As a temporary mitigation until patching is possible, consider disabling processing of Vorbis files with COVERART tags or implementing input validation to reject suspiciously large base64-encoded cover art data, though patching remains the only complete solution.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the gst_vorbis_tag_add_coverart function within gstvorbistag.c of the GStreamer multimedia framework's base plugins component. According to the CPE data, this affects GStreamer gstreamer-plugins-base versions prior to 0.10.23 and Ubuntu Linux 8.10 systems. The root cause is CWE-190 (Integer Overflow or Wraparound), where the function fails to properly validate the size of base64-decoded COVERART tag data before allocating memory, allowing an attacker to trigger an integer overflow that results in undersized buffer allocation and subsequent heap corruption during the decoding process.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/Au:N/C:P/I:P/A:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag.c) in vorbistag in gst-plugins-base (aka gstreamer-plugins-base) before 0.10.23 in GStreamer allows context-dependent attackers to execute arbitrary code via a crafted COVERART tag that is converted from a base64 representation, which triggers a heap-based buffer overflow.
Executive ViewAI
CVE-2009-0586 presents notable security risk, a integer overflow vulnerability rated CVSS 7.5. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
GitHub PoC
Exploit-DB