What is the CVSS score of CVE-2017-5843?

CVE-2017-5843 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 7.1%.

Which versions of GStreamer are affected by CVE-2017-5843?

Organizations using GStreamer face notable risk from CVE-2017-5843, a use-after-free vulnerability rated CVSS 7.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2017-5843?

Within 7 days: Identify all affected systems running GStreamer and apply vendor patches promptly. If patching is delayed, consider network segmentation to limit exposure.

GStreamer CVE-2017-5843

HIGH

Use After Free (CWE-416)

2017-02-09 cve@mitre.org

Denial Of Service Memory Corruption Use After Free

7.5

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:45 vuln.today

Patch released

Mar 17, 2026 - 20:45 nvd

Patch available

CVE Published

Feb 09, 2017 - 15:59 nvd

HIGH 7.5

DescriptionCVE.org

Multiple use-after-free vulnerabilities in the (1) gst_mini_object_unref, (2) gst_tag_list_unref, and (3) gst_mxf_demux_update_essence_tracks functions in GStreamer before 1.10.3 allow remote attackers to cause a denial of service (crash) via vectors involving stream tags, as demonstrated by 02785736.mxf.

AnalysisAI

Multiple use-after-free vulnerabilities exist in GStreamer's handling of MXF (Material eXchange Format) media files, affecting versions prior to 1.10.3. Remote attackers can exploit these flaws by crafting malicious MXF files that trigger memory corruption in functions handling stream tags (gst_mini_object_unref, gst_tag_list_unref, and gst_mxf_demux_update_essence_tracks), causing application crashes and denial of service. With an EPSS score of 7.13% (91st percentile), this vulnerability has moderate real-world exploitation probability, though no KEV listing indicates limited active exploitation.

Technical ContextAI

GStreamer is a widely-used multimedia framework for audio and video processing on Linux and other platforms, affected per CPE cpe:2.3:a:gstreamer:gstreamer. The vulnerability stems from CWE-416 (Use After Free) errors where memory is accessed after being freed during the parsing and demuxing of MXF container files. The three affected functions—gst_mini_object_unref (reference counting), gst_tag_list_unref (tag metadata handling), and gst_mxf_demux_update_essence_tracks (MXF-specific track management)—fail to properly manage object lifecycles when processing malformed stream tags. This class of vulnerability allows freed memory to be dereferenced, leading to undefined behavior that attackers can leverage for crashes or potentially more severe exploitation.

RemediationAI

Upgrade GStreamer to version 1.10.3 or later as documented in the official release advisory at https://gstreamer.freedesktop.org/releases/1.10/#1.10.3. Distribution-specific patches are available through Debian (https://www.debian.org/security/2017/dsa-3818), Red Hat (https://access.redhat.com/errata/RHSA-2017:2060), and Gentoo (https://security.gentoo.org/glsa/201705-10) security advisories. Until patching is completed, implement defense-in-depth measures including restricting processing of untrusted MXF files, running media processing in sandboxed environments with limited privileges, and validating file sources. Organizations with automated media processing pipelines should prioritize patching to prevent denial of service attacks against production systems.