What is the CVSS score of CVE-2017-5845?

CVE-2017-5845 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 3.1%.

Which versions of Gstreamer are affected by CVE-2017-5845?

Organizations using gst/avi/gstavidemux.c in gst-plugins-good in GStreamer face notable risk from CVE-2017-5845, a out-of-bounds read vulnerability rated CVSS 7.5.. A patch is available.

How to fix or mitigate CVE-2017-5845?

Within 7 days: Identify all affected systems running gst/avi/gstavidemux.c in gst-plugins-good in GStreamer and apply vendor patches promptly. Vendor patch is available.

Gstreamer CVE-2017-5845

HIGH

Out-of-bounds Read (CWE-125)

2017-02-09 cve@mitre.org

Buffer Overflow Denial Of Service Information Disclosure Gstreamer

7.5

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:45 vuln.today

Patch released

Mar 17, 2026 - 20:45 nvd

Patch available

CVE Published

Feb 09, 2017 - 15:59 nvd

HIGH 7.5

DescriptionCVE.org

The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a ncdt sub-tag that "goes behind" the surrounding tag.

AnalysisAI

A memory safety vulnerability in the AVI demuxer component of GStreamer allows remote attackers to crash applications by providing a malformed AVI file with a malicious ncdt sub-tag. GStreamer versions before 1.10.3 are affected across multiple distributions. With an EPSS score of 3.11% (87th percentile), this vulnerability has moderate real-world exploitation probability, though no active exploitation (KEV listing) has been reported.

Technical ContextAI

This vulnerability affects gst-plugins-good in GStreamer (CPE: cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*), specifically the gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c which handles parsing of AVI container format metadata. The root cause is classified as CWE-125 (Out-of-bounds Read), where a specially crafted ncdt sub-tag can reference memory locations that extend beyond the boundaries of the surrounding tag structure. GStreamer is a widely-used multimedia framework for constructing graphs of media-handling components, and the AVI demuxer is responsible for parsing Microsoft AVI container files. When processing malformed ncdt tags, the parser fails to validate that sub-tag offsets remain within the parent tag's memory region, leading to invalid memory access.

RemediationAI

Upgrade GStreamer and gst-plugins-good to version 1.10.3 or later as documented in the official release advisory at https://gstreamer.freedesktop.org/releases/1.10/#1.10.3. Linux distribution users should apply vendor-specific patches: Debian users should follow DSA-3820 (http://www.debian.org/security/2017/dsa-3820), Red Hat Enterprise Linux users should apply RHSA-2017:2060 (https://access.redhat.com/errata/RHSA-2017:2060), and Gentoo users should follow GLSA-201705-10 (https://security.gentoo.org/glsa/201705-10). Patches addressing the bounds checking issue in gst_avi_demux_parse_ncdt are detailed in the oss-security mailing list at http://www.openwall.com/lists/oss-security/2017/02/02/9. Until patching is complete, consider restricting GStreamer-based applications from processing untrusted AVI files from network sources, or implement input validation and sandboxing for media processing workflows in high-risk environments.