Gstreamer
CVE-2017-5844
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Division safety checks
|
| Impact | While the CVSS score of 5.5 (Medium) indicates moderate severity, the EPSS score of 0.72 (72nd percentile) suggests below-average exploitation probability in the wild, tempering immediate concern. The attack vector is local (AV:L) and requires no privileges but does require user interaction (UI:R), meaning an attacker must trick a user into opening a malicious ASF file rather than achieving remote code execution. The impact is availability only (denial of service via crash), not confidentiality or integrity compromise. However, this vulnerability is not listed as actively exploited in the Known Exploited Vulnerabilities (KEV) catalog, and while patches have been available since GStreamer 1.10.3 (released February 2017), the existence of multiple distribution advisories (Debian DSA-3819, Red Hat RHSA-2017:2060, Gentoo GLSA-201705-10, and Debian LTS advisories as recent as February 2020) indicates slow adoption of patched versions in production systems. For systems accepting untrusted media files (streaming services, media conversion tools, user-submitted content platforms), this represents a legitimate DoS vector despite its relatively low EPSS score. |
| Exploit ScenarioDerived | An attacker crafts a malicious ASF audio file with specially manipulated headers containing invalid sample rate or channel configuration values that trigger division by zero in the gst_riff_create_audio_caps parsing routine. The attacker then uploads this file to a media sharing platform, embeds it in a phishing email, or hosts it on a website, enticing users to open or stream the file through a GStreamer-based media player or web browser plugin. When the vulnerable application attempts to process the file and introspect its audio codec capabilities, the floating point exception immediately crashes the player or browser tab, achieving denial of service with minimal user deception required since the attack occurs during normal file opening rather than requiring code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A floating point exception vulnerability exists in GStreamer's gst_riff_create_audio_caps function within gst-plugins-base versions prior to 1.10.3, allowing remote attackers to trigger a denial of service crash by supplying a specially crafted ASF (Advanced Systems Format) audio file. The vulnerability requires user interaction (file opening) but no elevated privileges, making it exploitable through common media playback scenarios. With an EPSS score of 0.72 (72nd percentile) and confirmed patch availability from the vendor, this represents a moderate real-world risk primarily affecting applications and systems that process untrusted media files.
RemediationAI
Immediately upgrade GStreamer and gst-plugins-base to version 1.10.3 or later (see vendor advisory at https://gstreamer.freedesktop.org/releases/1.10/#1.10.3). For distributions, apply the respective security updates: Debian systems should install the patched packages from DSA-3819, Red Hat systems should apply RHSA-2017:2060, and Gentoo systems should follow GLSA-201705-10 guidance. If immediate patching is not feasible, implement input validation at the application level by rejecting or sandboxing ASF files from untrusted sources, disable ASF/WMA codec support if not required, and isolate media processing to a restricted user account without network access. Organizations relying on older LTS distributions should prioritize backporting security fixes or planning upgrades, as Debian LTS patches were still being released for this vulnerability as of February 2020.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the gst-riff library (gst-libs/gst/riff/riff-media.c) within GStreamer's multimedia framework, specifically in the audio capability creation routine used to parse ASF container metadata. The root cause is classified as CWE-369 (Divide By Zero), indicating that the gst_riff_create_audio_caps function performs division or modulo operations on attacker-controlled values derived from ASF file headers without proper validation or bounds checking. GStreamer is a widely-used multimedia library (affected CPE: cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*) integrated into numerous desktop environments, media players, and web browsers for audio and video processing. The parsing occurs when GStreamer attempts to introspect codec parameters from malformed ASF container headers, which can specify invalid sample rates or channel configurations that lead to zero or null values in arithmetic operations.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted ASF file.
Executive ViewAI
Organizations using gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer should be aware of moderate risk from CVE-2017-5844 rated CVSS 5.5. Exploitation could compromise the security of affected deployments. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
GitHub PoC
Exploit-DB