Gstreamer
CVE-2017-5845
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS v3.0 score of 7.5 (High) reflects a network-exploitable vulnerability with low attack complexity requiring no privileges or user interaction, but limited to availability impact (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The EPSS score of 3.11% at the 87th percentile indicates moderate exploitation likelihood compared to other vulnerabilities, suggesting attackers have not widely adopted this flaw despite its accessibility. The absence of KEV listing confirms no known active exploitation in the wild. The attack requires only delivering a malicious AVI file through network channels (web browsers, streaming applications, media players), making it automatable. However, the impact is strictly denial-of-service with no code execution, data theft, or privilege escalation potential. Real-world risk is moderate: while the technical barrier is low and patches are available, the limited impact and lack of observed exploitation suggest this is not a critical immediate priority unless GStreamer processes untrusted media files in high-availability environments. |
| Exploit ScenarioDerived | An attacker hosts a malicious AVI video file on a website or delivers it via email attachment with a crafted ncdt sub-tag that references memory beyond the parent tag boundaries. When a victim opens the file in any application using GStreamer for media playback (web browsers with GStreamer backend, media players, video editing software), the gst_avi_demux_parse_ncdt function performs an out-of-bounds read, causing the application to crash and denying service to the user. Proof-of-concept details and patches demonstrating the vulnerability were publicly disclosed on the oss-security mailing list in February 2017, lowering the technical barrier for exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A memory safety vulnerability in the AVI demuxer component of GStreamer allows remote attackers to crash applications by providing a malformed AVI file with a malicious ncdt sub-tag. GStreamer versions before 1.10.3 are affected across multiple distributions. With an EPSS score of 3.11% (87th percentile), this vulnerability has moderate real-world exploitation probability, though no active exploitation (KEV listing) has been reported.
RemediationAI
Upgrade GStreamer and gst-plugins-good to version 1.10.3 or later as documented in the official release advisory at https://gstreamer.freedesktop.org/releases/1.10/#1.10.3. Linux distribution users should apply vendor-specific patches: Debian users should follow DSA-3820 (http://www.debian.org/security/2017/dsa-3820), Red Hat Enterprise Linux users should apply RHSA-2017:2060 (https://access.redhat.com/errata/RHSA-2017:2060), and Gentoo users should follow GLSA-201705-10 (https://security.gentoo.org/glsa/201705-10). Patches addressing the bounds checking issue in gst_avi_demux_parse_ncdt are detailed in the oss-security mailing list at http://www.openwall.com/lists/oss-security/2017/02/02/9. Until patching is complete, consider restricting GStreamer-based applications from processing untrusted AVI files from network sources, or implement input validation and sandboxing for media processing workflows in high-risk environments.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects gst-plugins-good in GStreamer (CPE: cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*), specifically the gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c which handles parsing of AVI container format metadata. The root cause is classified as CWE-125 (Out-of-bounds Read), where a specially crafted ncdt sub-tag can reference memory locations that extend beyond the boundaries of the surrounding tag structure. GStreamer is a widely-used multimedia framework for constructing graphs of media-handling components, and the AVI demuxer is responsible for parsing Microsoft AVI container files. When processing malformed ncdt tags, the parser fails to validate that sub-tag offsets remain within the parent tag's memory region, leading to invalid memory access.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a ncdt sub-tag that "goes behind" the surrounding tag.
Executive ViewAI
Organizations using gst/avi/gstavidemux.c in gst-plugins-good in GStreamer face notable risk from CVE-2017-5845, a out-of-bounds read vulnerability rated CVSS 7.5. Exploitation could compromise the security of affected deployments. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
GitHub PoC
Exploit-DB