Gstreamer
CVE-2017-5846
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.0 score of 5.5 reflects a medium severity vulnerability with local attack vector and low complexity (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), meaning no special privileges or complex conditions are needed, only user interaction. However, the EPSS score of 0.80% (74th percentile) indicates relatively low real-world exploitation probability, suggesting this vulnerability, while straightforward to trigger, is not frequently exploited in the wild. The vulnerability is limited to availability impact (denial of service) with no confidentiality or integrity compromise, reducing overall business impact. The presence of multiple vendor advisories (Debian DSA-3821, Gentoo GLSA-201705-10) and a fix released in GStreamer 1.10.3 indicates responsible disclosure. This is a legitimate but lower-priority vulnerability suitable for standard patch management cycles rather than emergency response. |
| Exploit ScenarioDerived | An attacker crafts a malicious ASF video file with an extended stream properties header containing an invalid language count value (e.g., a count much larger than actual allocated buffer space). When a user opens this file in a GStreamer-based media player or application (such as VLC, GNOME Videos, or a custom application using GStreamer), the gst_asf_demux_process_ext_stream_props function attempts to read language metadata using the malformed count, causing an out-of-bounds memory read. This results in a segmentation fault and application crash, achieving denial of service. The attack requires only local file access and user interaction, making it easily deliverable via email attachment or compromised media download sites. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A out-of-bounds read vulnerability exists in GStreamer's ASF demuxer (gst-plugins-ugly) that allows remote attackers to trigger a denial of service by crafting malicious video files with specially crafted extended stream properties containing an invalid number of languages. GStreamer versions before 1.10.3 are affected, and the vulnerability is triggered through local user interaction with a malicious media file, resulting in application crashes due to invalid memory access. While EPSS scoring indicates relatively low exploitation probability (0.80%, 74th percentile), this is a straightforward denial of service with clear triggering mechanisms.
RemediationAI
Upgrade GStreamer to version 1.10.3 or later immediately; users on older stable branches should check their distribution's backports (Debian LTS provides patched versions as noted in their announcement). Verify that gst-plugins-ugly is updated as part of the GStreamer installation, since the vulnerable code is in that plugin package. Until patching is complete, restrict user access to untrusted media files and educate users to avoid opening ASF/WMV files from untrusted sources. Organizations relying on GStreamer in media processing pipelines should prioritize this update and validate patches against regression testing with existing media assets. For further details, consult the official GStreamer release notes at https://gstreamer.freedesktop.org/releases/1.10/#1.10.3 and the Debian security advisory at http://www.debian.org/security/2017/dsa-3821.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the gst_asf_demux_process_ext_stream_props function within gst/asfdemux/gstasfdemux.c in GStreamer's gst-plugins-ugly library (CPE: cpe:2.3:a:gstreamer:gstreamer). ASF (Advanced Systems Format) is a multimedia container format developed by Microsoft, commonly used in WMV and WMA files. The flaw is classified as CWE-125 (Out-of-bounds Read), indicating the function fails to properly validate the number of languages field in extended stream properties before reading memory. When processing a crafted ASF file with a malformed language count, the demuxer reads beyond allocated buffer boundaries, causing memory access violations. This is a parsing vulnerability triggered during media file deserialization.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The gst_asf_demux_process_ext_stream_props function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors related to the number of languages in a video file.
Executive ViewAI
Organizations using gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer should be aware of moderate risk from CVE-2017-5846, a out-of-bounds read vulnerability rated CVSS 5.5. Exploitation could cause memory corruption or application crashes. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
GitHub PoC
Exploit-DB