What is the CVSS score of CVE-2017-5844?

CVE-2017-5844 has a CVSS 3.0 base score of 5.5 (Medium). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.7%.

Which versions of GStreamer are affected by CVE-2017-5844?

Organizations using gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer should be aware of moderate risk from CVE-2017-5844 rated CVSS 5.5.. A patch is available.

How to fix or mitigate CVE-2017-5844?

Within 30 days: Identify affected systems running gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStrea and apply vendor patches as part of regular patch cycle. Vendor patch is available.

GStreamer CVE-2017-5844

MEDIUM

Divide By Zero (CWE-369)

2017-02-09 cve@mitre.org

Denial Of Service

5.5

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:45 vuln.today

Patch released

Mar 17, 2026 - 20:45 nvd

Patch available

CVE Published

Feb 09, 2017 - 15:59 nvd

MEDIUM 5.5

DescriptionCVE.org

The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted ASF file.

AnalysisAI

A floating point exception vulnerability exists in GStreamer's gst_riff_create_audio_caps function within gst-plugins-base versions prior to 1.10.3, allowing remote attackers to trigger a denial of service crash by supplying a specially crafted ASF (Advanced Systems Format) audio file. The vulnerability requires user interaction (file opening) but no elevated privileges, making it exploitable through common media playback scenarios. With an EPSS score of 0.72 (72nd percentile) and confirmed patch availability from the vendor, this represents a moderate real-world risk primarily affecting applications and systems that process untrusted media files.

Technical ContextAI

The vulnerability resides in the gst-riff library (gst-libs/gst/riff/riff-media.c) within GStreamer's multimedia framework, specifically in the audio capability creation routine used to parse ASF container metadata. The root cause is classified as CWE-369 (Divide By Zero), indicating that the gst_riff_create_audio_caps function performs division or modulo operations on attacker-controlled values derived from ASF file headers without proper validation or bounds checking. GStreamer is a widely-used multimedia library (affected CPE: cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*) integrated into numerous desktop environments, media players, and web browsers for audio and video processing. The parsing occurs when GStreamer attempts to introspect codec parameters from malformed ASF container headers, which can specify invalid sample rates or channel configurations that lead to zero or null values in arithmetic operations.

RemediationAI

Immediately upgrade GStreamer and gst-plugins-base to version 1.10.3 or later (see vendor advisory at https://gstreamer.freedesktop.org/releases/1.10/#1.10.3). For distributions, apply the respective security updates: Debian systems should install the patched packages from DSA-3819, Red Hat systems should apply RHSA-2017:2060, and Gentoo systems should follow GLSA-201705-10 guidance. If immediate patching is not feasible, implement input validation at the application level by rejecting or sandboxing ASF files from untrusted sources, disable ASF/WMA codec support if not required, and isolate media processing to a restricted user account without network access. Organizations relying on older LTS distributions should prioritize backporting security fixes or planning upgrades, as Debian LTS patches were still being released for this vulnerability as of February 2020.