Gstreamer
CVE-2017-5839
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
|
| Impact | The CVSS 3.0 score of 7.5 (High) reflects the ease of exploitation - network accessible with no authentication required and low attack complexity. However, the impact is limited to availability only, with no confidentiality or integrity compromise possible. The EPSS score of 3.04% places this vulnerability in the 87th percentile, indicating above-average exploitation likelihood compared to other CVEs. This is not tracked in CISA's KEV catalog, suggesting no confirmed active exploitation in the wild. The combination of easy exploitation but limited impact (DoS only) makes this a medium-priority issue for most organizations - critical only for services where availability is paramount or where GStreamer processes untrusted media files from the internet. |
| Exploit ScenarioDerived | An attacker could host a malicious WAV audio file on a website or send it as an email attachment, containing deeply nested WAVEFORMATEX structures. When a vulnerable GStreamer-based application (such as a media player or streaming service) attempts to process this file, it would trigger uncontrolled recursion leading to a stack overflow and application crash. While no public proof-of-concept has been referenced, the straightforward nature of the vulnerability (crafting nested structures) makes exploitation relatively simple for anyone familiar with RIFF file formats. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A stack overflow vulnerability exists in the GStreamer multimedia framework's RIFF media handling component, where improper recursion limits when processing nested WAVEFORMATEX structures can cause denial of service crashes. The vulnerability affects GStreamer versions before 1.10.3 and allows remote attackers to crash applications using the framework without authentication. With an EPSS score of 3.04% (87th percentile), this vulnerability has a higher-than-average likelihood of exploitation in the wild, though it is limited to denial of service impact only.
RemediationAI
Upgrade GStreamer gst-plugins-base to version 1.10.3 or later, which includes the fix for this vulnerability as documented in the official release notes at https://gstreamer.freedesktop.org/releases/1.10/#1.10.3. For systems using distribution packages, apply the vendor-specific security updates: Debian users should install DSA-3819, Red Hat users should apply RHSA-2017:2060, and Gentoo users should follow GLSA-201705-10. As a temporary mitigation until patching is possible, avoid processing untrusted RIFF/WAV files or implement input validation to reject files with excessive nesting depth before passing them to GStreamer.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a widely-used open source multimedia framework that provides a pipeline-based architecture for handling audio and video processing. The vulnerability resides in the gst_riff_create_audio_caps function within the RIFF media handling library (gst-libs/gst/riff/riff-media.c), which processes Resource Interchange File Format data commonly used in WAV audio files. This is a classic case of CWE-674 (Uncontrolled Recursion), where the function fails to implement proper depth limits when parsing nested WAVEFORMATEX structures within RIFF files, allowing maliciously crafted files to trigger infinite recursion until the stack is exhausted.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, which allows remote attackers to cause a denial of service (stack overflow and crash) via vectors involving nested WAVEFORMATEX.
Executive ViewAI
Organizations using gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer face notable risk from CVE-2017-5839 rated CVSS 7.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
GitHub PoC
Exploit-DB