Gstreamer
CVE-2017-5842
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.0 vector (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates a local attack vector requiring user interaction (opening a crafted SMI file), low attack complexity, and impact limited to availability (denial of service), with no confidentiality or integrity impact. The EPSS score of 0.80% (74th percentile) suggests this vulnerability is less likely to be exploited in the wild compared to the median CVE. However, several factors elevate practical risk: (1) a vendor patch has been released (GStreamer 1.10.3), indicating the issue is reproducible and well-understood; (2) proof-of-concept files are documented (OneNote_Manager.smi); (3) the vulnerability requires only user interaction with a crafted subtitle file, making delivery feasible via email or malicious websites. The SSVC framework would classify this as having low exploitation probability (EPSS 0.80%), affected in limited software, and technical impact limited to denial of service. This is not a critical priority but warrants timely patching in environments where GStreamer processes untrusted subtitle content. |
| Exploit ScenarioDerived | An attacker crafts a malicious SAMI subtitle file (e.g., OneNote_Manager.smi) with specially crafted element attributes that trigger out-of-bounds writes when parsed by the vulnerable html_context_handle_element function. The attacker distributes this file via email or embeds it in a video file shared on a media platform. When a user opens the subtitle file in a media player or application using vulnerable GStreamer versions, the parser crashes due to buffer overflow, causing denial of service. Because the attack vector is local and requires user interaction, the risk is moderate but real in scenarios involving untrusted subtitle distribution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A out-of-bounds write vulnerability exists in the SAMI subtitle parser (samiparse.c) within GStreamer's gst-plugins-base library before version 1.10.3, triggered when processing maliciously crafted SMI subtitle files. The vulnerability allows remote attackers to cause a denial of service condition by crashing the application through memory corruption. With an EPSS score of 0.80% (74th percentile), patch availability from the vendor, and documented proof-of-concept files (OneNote_Manager.smi), this represents a low-to-moderate exploitation risk despite the moderate CVSS 5.5 score.
RemediationAI
Upgrade GStreamer and gst-plugins-base to version 1.10.3 or later as advised by the GStreamer project (https://gstreamer.freedesktop.org/releases/1.10/#1.10.3). For Linux distributions, apply official patches via package managers: Debian users should apply DSA-3819, Red Hat users should apply RHSA-2017:2060, and Gentoo users should apply GLSA-201705-10. Until patching is possible, restrict the use of GStreamer to process only subtitle files from trusted sources, disable automatic subtitle loading in media players, and avoid opening SAMI files (.smi) from untrusted origins. Organizations should prioritize patching systems in environments where GStreamer processes user-supplied or internet-sourced subtitle content.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the html_context_handle_element function within gst/subparse/samiparse.c, which is part of GStreamer's subtitle parsing subsystem. GStreamer (CPE: cpe:2.3:a:gstreamer:gstreamer) is a multimedia framework used across Linux distributions and media applications for audio/video processing and subtitle handling. The root cause is classified as CWE-787 (Out-of-bounds Write), where insufficient bounds checking in the SAMI parser allows an attacker-controlled SMI file to write data beyond allocated buffer boundaries. SAMI (Synchronized Accessible Media Interchange) is a legacy caption format commonly embedded in media containers; the parser fails to properly validate element attributes or buffer sizes before writing parsed content, leading to heap or stack corruption depending on memory layout.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The html_context_handle_element function in gst/subparse/samiparse.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted SMI file, as demonstrated by OneNote_Manager.smi.
Executive ViewAI
Organizations using gst/subparse/samiparse.c in gst-plugins-base in GStreamer should be aware of moderate risk from CVE-2017-5842, a out-of-bounds write vulnerability rated CVSS 5.5. Exploitation could cause memory corruption or application crashes. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
GitHub PoC
Exploit-DB