Gstreamer
CVE-2017-5848
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 7.5 (High) reflects network-based exploitation (AV:N) with low attack complexity (AC:L) requiring no privileges (PR:N) or user interaction (UI:N), impacting only availability (A:H). However, the real-world risk is moderate rather than critical. The EPSS score of 6.52% at the 91st percentile indicates this vulnerability is more likely to be exploited than 91% of all CVEs, suggesting non-trivial exploitation interest. The attack requires convincing a victim to process malicious media content, which limits opportunistic exploitation despite the network attack vector. The technical impact is limited to denial of service (application crash) with no confidentiality or integrity impact, reducing the severity for most enterprise environments. Patches have been available since February 2017 with widespread distribution through security advisories, meaning vulnerable systems at this point likely represent unpatched legacy deployments. This is a legitimate priority for media processing servers and desktop environments using GStreamer, but not an emergency given the DoS-only impact and patch availability. |
| Exploit ScenarioDerived | An attacker hosts a malicious MPEG media file on a web server or embeds it in an email attachment. When a victim opens the file using any application leveraging GStreamer for media playback (web browsers, media players, or automated media processing services), the crafted PSM data triggers an out-of-bounds memory read in the demuxer, causing the application to crash and denying service to the user. The attack requires no authentication and low complexity, making it practical for targeted attacks against media processing infrastructure or widespread distribution via malicious media files. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
This is an out-of-bounds read vulnerability in GStreamer's gst-plugins-bad MPEG demuxer component that allows remote attackers to crash applications by sending specially crafted MPEG Program Stream Map (PSM) data. The vulnerability affects GStreamer installations across multiple Linux distributions including Debian 8.0/9.0 and Red Hat Enterprise Linux 7.x variants. With an EPSS score of 6.52% (91st percentile), this vulnerability has a moderately elevated probability of exploitation in the wild, though no active exploitation or KEV listing is indicated.
RemediationAI
Update GStreamer gst-plugins-bad to the patched version released in February 2017 or later. Debian users should apply updates per DSA-3818 available at http://www.debian.org/security/2017/dsa-3818. Red Hat Enterprise Linux 7 users should apply RHSA-2017:2060 available at https://access.redhat.com/errata/RHSA-2017:2060. Gentoo users should follow GLSA-201705-10 at https://security.gentoo.org/glsa/201705-10. The patch details are available in the oss-security mailing list at http://www.openwall.com/lists/oss-security/2017/02/02/9 and the upstream bug report at https://bugzilla.gnome.org/show_bug.cgi?id=777957. As a temporary mitigation until patching is complete, restrict processing of untrusted MPEG streams, implement input validation at network boundaries, and consider disabling GStreamer-based media processing for untrusted sources. Run GStreamer applications with minimal privileges to limit the impact of crashes.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a widely-used multimedia framework that handles media stream parsing and playback. The vulnerability resides in the gst_ps_demux_parse_psm function within gstmpegdemux.c of the gst-plugins-bad package, specifically in the MPEG Program Stream demultiplexer. This component is responsible for parsing MPEG transport streams including Program Stream Map (PSM) structures that describe stream composition. The root cause is CWE-125 (Out-of-bounds Read), meaning the parser reads memory beyond allocated buffer boundaries when processing malformed PSM data. Affected products according to CPE data include cpe:2.3:a:gstreamer:gstreamer and multiple OS distributions that bundle GStreamer: Debian 8.0 and 9.0, Red Hat Enterprise Linux Desktop 7.0, and Red Hat Enterprise Linux Server 7.0 through various Extended Update Support versions (7.4, 7.5, 7.6, 7.7) and AUS 7.4.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors involving PSM parsing.
Executive ViewAI
CVE-2017-5848 presents notable security risk, a out-of-bounds read vulnerability rated CVSS 7.5. Exploitation could compromise the security of affected deployments. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
GitHub PoC
Exploit-DB