Gstreamer
CVE-2017-5838
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS v3.0 score of 7.5 (High) reflects a remotely exploitable vulnerability (AV:N) with low attack complexity (AC:L) that requires no privileges (PR:N) or user interaction (UI:N), impacting only availability (A:H). The EPSS score of 2.76% places it in the 86th percentile, indicating above-average exploitation likelihood compared to other CVEs. While not listed in CISA KEV as actively exploited, the combination of remote exploitability, no authentication requirements, and straightforward attack vector makes this a priority for patching. The vulnerability is limited to denial of service rather than code execution or data theft, which somewhat reduces the overall risk compared to other high-CVSS vulnerabilities. |
| Exploit ScenarioDerived | An attacker could craft a malicious media file or stream containing specially formatted ISO8601 datetime strings in metadata fields, which when processed by a vulnerable GStreamer instance would trigger an out-of-bounds heap read. This could occur when a media player or streaming service processes untrusted content, causing the application to crash and resulting in service disruption. The attack requires no authentication and can be executed remotely by simply providing malformed input to any application using the vulnerable GStreamer library. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A heap buffer overflow vulnerability exists in GStreamer multimedia framework versions before 1.10.3, where malformed ISO8601 datetime strings can trigger out-of-bounds memory reads. The vulnerability affects the gst_date_time_new_from_iso8601_string function and allows remote attackers to cause denial of service conditions without requiring authentication. With an EPSS score of 2.76% (86th percentile), this vulnerability has above-average likelihood of exploitation, though it is not currently listed in CISA KEV.
RemediationAI
Upgrade GStreamer to version 1.10.3 or later, which contains the fix for this vulnerability as documented in the official release notes at https://gstreamer.freedesktop.org/releases/1.10/#1.10.3. Linux distribution users should apply vendor-specific security updates: Debian users should install DSA-3822, Red Hat users should apply RHSA-2017:2060, and Gentoo users should follow GLSA 201705-10. For systems that cannot be immediately patched, consider implementing input validation for datetime strings before they reach GStreamer processing, though upgrading remains the recommended solution. Patches are available from multiple sources including the openwall.com security mailing list.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a widely-used open source multimedia framework that handles audio and video processing across Linux distributions and applications. The vulnerability resides in the gst/gstdatetime.c file, specifically in the gst_date_time_new_from_iso8601_string function that parses ISO8601-formatted datetime strings. This is classified as CWE-125 (Out-of-bounds Read), a memory safety issue where the application reads data past the end of an allocated buffer. Based on the CPE identifier cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*, all GStreamer versions prior to 1.10.3 are affected across all platforms where GStreamer is deployed.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The gst_date_time_new_from_iso8601_string function in gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a malformed datetime string.
Executive ViewAI
Organizations using gst/gstdatetime.c in GStreamer face notable risk from CVE-2017-5838, a out-of-bounds read vulnerability rated CVSS 7.5. Exploitation could compromise the security of affected deployments. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
GitHub PoC
Exploit-DB