Gstreamer
CVE-2017-5847
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Despite the high CVSS score of 7.5, the real-world risk is moderate based on multiple factors. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-based attacks requiring no privileges or user interaction, which is concerning. However, the EPSS score of 3.07% suggests relatively low exploitation probability compared to other vulnerabilities. The attack only achieves denial of service (availability impact) with no confidentiality or integrity compromise. This is not listed in CISA KEV, indicating no known active exploitation. The vulnerability requires an attacker to deliver malformed media files to the target system, limiting practical attack scenarios to situations where users process untrusted media content. For most organizations, this represents a medium priority patch unless they operate media processing services exposed to untrusted input. |
| Exploit ScenarioDerived | An attacker could host a malicious ASF media file on a web server or distribute it through file-sharing platforms, waiting for victims to download and play it using a vulnerable GStreamer-based media player. When the media player attempts to parse the file's extended content descriptors, the out-of-bounds read triggers a segmentation fault, crashing the application. While proof-of-concept code is not publicly documented, the low attack complexity suggests that crafting malicious ASF files would be straightforward for skilled attackers with knowledge of the ASF file format specification. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A buffer overflow vulnerability in GStreamer's ASF demuxer component allows remote attackers to trigger out-of-bounds heap reads when processing malformed extended content descriptors in ASF media files. The vulnerability affects GStreamer gst-plugins-ugly and can cause denial of service through application crashes when parsing specially crafted media content. With an EPSS score of 3.07% (87th percentile), this vulnerability has moderate real-world exploitation likelihood but no known active exploitation in the wild.
RemediationAI
Apply the official patch commit d21017b52a585f145e8d62781bcc1c5fefc7ee37 from the GStreamer repository or upgrade to a patched version of gst-plugins-ugly. Debian users should install the security updates provided in DSA-3821 (Debian 8/9) or the updates mentioned in the debian-lts-announce from May 2020. Gentoo users should refer to GLSA-201705-10 for updated packages. As a temporary mitigation, avoid processing ASF media files from untrusted sources or implement input validation to reject potentially malformed ASF files before they reach the GStreamer pipeline. The patch is readily available from multiple sources including the official GStreamer GitHub repository.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the gst_asf_demux_process_ext_content_desc function within gst/asfdemux/gstasfdemux.c in the gst-plugins-ugly module of GStreamer multimedia framework. GStreamer is a widely-used open source multimedia processing pipeline that handles various media formats including Microsoft's Advanced Systems Format (ASF). The flaw is classified as CWE-125 (Out-of-bounds Read), occurring when the demuxer fails to properly validate boundaries while parsing extended content descriptors in ASF files. Based on the CPE data, all versions of GStreamer prior to the patch are affected (cpe:2.3:a:gstreamer:gstreamer:*), along with Debian Linux 8.0 and 9.0 distributions that package the vulnerable version.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.
Executive ViewAI
CVE-2017-5847 presents notable security risk, a out-of-bounds read vulnerability rated CVSS 7.5. Exploitation could compromise the security of affected deployments. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
Exploit-DB