Gstreamer
CVE-2016-9445
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS v3.1 score of 7.5 (High) reflects network-based exploitation with low complexity, no privileges required, and no user interaction needed, though impact is limited to availability (denial of service). However, the EPSS score of 2.41% (85th percentile) suggests moderate real-world exploitation likelihood. The existence of a public proof-of-concept from security researcher Chris Evans (Scary Beasts Security blog) significantly increases exploit accessibility. This vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation in critical infrastructure. From an SSVC perspective: exploitation is public (POC available), the attack is automatable (network-based parser vulnerability), but technical impact appears limited to DoS rather than arbitrary code execution. Red Hat issued multiple security advisories (RHSA-2016-2974, RHSA-2017-0018, RHSA-2017-0021) indicating enterprise distributions were affected. Real-world priority is moderate: while the CVSS is high and exploitation is straightforward, the impact is primarily availability disruption rather than data breach or system compromise, and patches have been available since late 2016. |
| Exploit ScenarioDerived | An attacker crafts a malicious VMnc-encoded video file or stream with intentionally oversized width and height dimension values. When a victim opens this file in a media player using GStreamer 1.10.0, or when an automated media processing system ingests the malicious stream, the vmnc decoder performs an integer overflow calculation that allocates an insufficient buffer. The decoder then writes frame data beyond the allocated buffer boundaries, causing the application to crash and denying service to legitimate users. A public proof-of-concept demonstrating this attack is available, lowering the barrier for exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
An integer overflow vulnerability exists in the vmnc decoder component of GStreamer that allows remote attackers to trigger a buffer overflow and crash the application. GStreamer version 1.10.0 is confirmed affected, with exploitation requiring no authentication or user interaction over the network. A public proof-of-concept exploit exists (published on Scary Beasts Security blog), and EPSS indicates a 2.41% probability of exploitation in the wild (85th percentile), making this a moderate real-world risk.
RemediationAI
Apply the upstream patch available in GStreamer's gst-plugins-bad repository (commit 4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe at https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/gst/vmnc/vmncdec.c?id=4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe). For Red Hat Enterprise Linux systems, install updates per RHSA-2016-2974, RHSA-2017-0018, or RHSA-2017-0021 as appropriate for your distribution version. Gentoo users should follow GLSA-201705-10 guidance. As a temporary mitigation until patching, disable or remove the vmnc decoder plugin from GStreamer if VMware video codec support is not required, restrict processing of media files to trusted sources only, and implement network segmentation to limit exposure of systems running vulnerable GStreamer versions to untrusted network content.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the VMnc (VMware video codec) decoder plugin in GStreamer's gst-plugins-bad package, specifically in the vmncdec.c file. GStreamer is a widely-used multimedia framework for constructing graphs of media-handling components. The root cause is CWE-190 (Integer Overflow or Wraparound), where the decoder fails to properly validate large width and height values in VMnc-encoded video streams. When these dimensions are multiplied to calculate buffer sizes, an integer overflow occurs, resulting in allocation of an undersized buffer. Subsequent writes to this buffer cause a heap-based buffer overflow, leading to application crash or potential memory corruption. The affected product per CPE is cpe:2.3:a:gstreamer:gstreamer:1.10.0.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service (crash) via large width and height values, which triggers a buffer overflow.
Executive ViewAI
Organizations using Integer overflow in the vmnc decoder in the gstreamer face notable risk from CVE-2016-9445, a integer overflow vulnerability rated CVSS 7.5. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
GitHub PoC
Exploit-DB