Gstreamer
CVE-2019-9928
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.0 score of 8.8 reflects a network-based attack (AV:N) with low complexity (AC:L) that requires no privileges (PR:N) but does require user interaction (UI:R), potentially leading to complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). However, the real-world risk is moderated by the user interaction requirement - victims must actively connect to a malicious RTSP server, limiting opportunistic attacks. The vulnerability is not listed in CISA's KEV catalog, suggesting no confirmed active exploitation in the wild. Without specific EPSS data provided, but given the age of the vulnerability (2019), widespread patching availability, and the requirement for targeted attacks, this represents a medium-priority risk for most organizations, elevated to high priority only for systems that regularly connect to untrusted RTSP sources. |
| Exploit ScenarioDerived | An attacker sets up a malicious RTSP streaming server and tricks a user into connecting to it using a GStreamer-based media player or application. When the vulnerable GStreamer client attempts to establish the RTSP connection, the malicious server responds with specially crafted data that overflows the heap buffer in the connection parser, potentially allowing the attacker to execute arbitrary code on the victim's system. The attack requires the victim to actively initiate a connection to the malicious server, either through social engineering or by compromising legitimate RTSP server URLs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to execute arbitrary code by sending a specially crafted response from a malicious RTSP server. The vulnerability affects all GStreamer versions prior to 1.16.0 and requires user interaction (connecting to a malicious server), with a CVSS score of 8.8 indicating high severity. While no active exploitation has been confirmed (not in KEV), the vulnerability has been publicly disclosed with security advisories available, and the attack vector is relatively straightforward for attackers with RTSP protocol knowledge.
RemediationAI
Upgrade GStreamer to version 1.16.0 or later as detailed in the official security advisory at https://gstreamer.freedesktop.org/security/sa-2019-0001.html. For distribution-packaged versions, apply the vendor-specific security updates: Debian users should reference DSA-4437 (https://www.debian.org/security/2019/dsa-4437), Ubuntu users should apply USN-3958-1 (https://usn.ubuntu.com/3958-1/), and openSUSE users should consult their respective security announcements. As a temporary mitigation until patching is complete, avoid connecting GStreamer-based applications to untrusted RTSP servers and consider implementing network segmentation to restrict RTSP connections to known, trusted sources only.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a widely-used open-source multimedia framework that handles various media formats and protocols, including RTSP (Real Time Streaming Protocol) commonly used for streaming video content. The vulnerability stems from improper bounds checking in the RTSP connection parser, classified as CWE-787 (Out-of-bounds Write), where the parser fails to validate the size of incoming data before copying it to a heap buffer. Based on the CPE data, the core affected product is GStreamer itself (cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*) with versions before 1.16.0, and the vulnerability has been integrated into several Linux distributions including Debian 8.0 and 9.0, Ubuntu 16.04 LTS, 18.04 LTS, and 18.10.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.
Executive ViewAI
Organizations using GStreamer before 1.16.0 face significant risk from CVE-2019-9928, a out-of-bounds write vulnerability rated CVSS 8.8. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. With an EPSS score of 17%, exploitation is likely in exposed deployments. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
An integer overflow vulnerability in GStreamer's matroska demuxer can cause denial of service through segmentation fault
GitHub PoC
Exploit-DB