What is the CVSS score of CVE-2019-9928?

CVE-2019-9928 has a CVSS 3.0 base score of 8.8 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 17.3%.

Which versions of Debian Linux are affected by CVE-2019-9928?

Organizations using GStreamer before 1.16.0 face significant risk from CVE-2019-9928, a out-of-bounds write vulnerability rated CVSS 8.8.

How to fix or mitigate CVE-2019-9928?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. If patching is delayed, consider network segmentation to limit exposure.

Debian Linux CVE-2019-9928

HIGH

Out-of-bounds Write (CWE-787)

2019-04-24 cve@mitre.org

RCE Buffer Overflow Debian Linux Gstreamer Ubuntu Linux

8.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:45 vuln.today

CVE Published

Apr 24, 2019 - 15:29 nvd

HIGH 8.8

DescriptionCVE.org

GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially allowing remote code execution.

AnalysisAI

A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to execute arbitrary code by sending a specially crafted response from a malicious RTSP server. The vulnerability affects all GStreamer versions prior to 1.16.0 and requires user interaction (connecting to a malicious server), with a CVSS score of 8.8 indicating high severity. While no active exploitation has been confirmed (not in KEV), the vulnerability has been publicly disclosed with security advisories available, and the attack vector is relatively straightforward for attackers with RTSP protocol knowledge.

Technical ContextAI

GStreamer is a widely-used open-source multimedia framework that handles various media formats and protocols, including RTSP (Real Time Streaming Protocol) commonly used for streaming video content. The vulnerability stems from improper bounds checking in the RTSP connection parser, classified as CWE-787 (Out-of-bounds Write), where the parser fails to validate the size of incoming data before copying it to a heap buffer. Based on the CPE data, the core affected product is GStreamer itself (cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*) with versions before 1.16.0, and the vulnerability has been integrated into several Linux distributions including Debian 8.0 and 9.0, Ubuntu 16.04 LTS, 18.04 LTS, and 18.10.

RemediationAI

Upgrade GStreamer to version 1.16.0 or later as detailed in the official security advisory at https://gstreamer.freedesktop.org/security/sa-2019-0001.html. For distribution-packaged versions, apply the vendor-specific security updates: Debian users should reference DSA-4437 (https://www.debian.org/security/2019/dsa-4437), Ubuntu users should apply USN-3958-1 (https://usn.ubuntu.com/3958-1/), and openSUSE users should consult their respective security announcements. As a temporary mitigation until patching is complete, avoid connecting GStreamer-based applications to untrusted RTSP servers and consider implementing network segmentation to restrict RTSP connections to known, trusted sources only.