Gstreamer
CVE-2021-3497
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS 3.1 score of 7.8 appears high, the actual exploitation risk is relatively low based on multiple indicators. The CVSS vector (AV:L/AC:L/PR:N/UI:R) shows this requires local access and user interaction, significantly limiting attack opportunities compared to network-exploitable vulnerabilities. The EPSS score of 0.18% (39th percentile) indicates very low probability of active exploitation in the wild. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public proof-of-concept exploits are referenced. This appears to be a high-CVSS but low-real-world-risk issue that would primarily affect scenarios where untrusted media files are processed locally. |
| Exploit ScenarioDerived | An attacker would need to craft a malicious Matroska video file with specific malformations that trigger the use-after-free condition in GStreamer's error handling code. The victim would need to open or process this file using a GStreamer-based application, such as a media player or video editing software. Upon triggering the vulnerability, the attacker could potentially execute arbitrary code with the privileges of the user running the application, though no public proof-of-concept exists demonstrating this capability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A use-after-free vulnerability exists in GStreamer's Matroska demuxer that can be triggered when processing malformed video files, potentially allowing attackers to execute arbitrary code or cause application crashes. The vulnerability affects GStreamer versions before 1.18.4 and requires local access with user interaction to exploit. With an EPSS score of only 0.18% and no KEV listing, this vulnerability has low real-world exploitation probability despite its high CVSS score of 7.8.
RemediationAI
Upgrade GStreamer to version 1.18.4 or later, which contains the fix for this vulnerability. Patches are available from the vendor as noted in the Red Hat Bugzilla report at https://bugzilla.redhat.com/show_bug.cgi?id=1945339. For Debian users, apply the security updates referenced in DSA-4900 at https://www.debian.org/security/2021/dsa-4900. As a temporary mitigation until patching is complete, avoid processing untrusted or potentially malicious Matroska (MKV) files, and consider implementing sandboxing for media processing applications to limit the impact of potential exploitation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a widely-used multimedia framework that provides libraries for handling audio and video streams across Linux and other platforms. The vulnerability occurs in the Matroska (MKV) file format demuxer component, where error handling code paths can access memory that has already been freed (CWE-416: Use After Free). This class of vulnerability occurs when a program continues to use a pointer after the memory it references has been deallocated, leading to unpredictable behavior including potential code execution. The affected CPE entries indicate this impacts GStreamer on Debian Linux 9.0 and 10.0, as well as Red Hat Enterprise Linux 7.0 and 8.0.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.
Executive ViewAI
CVE-2021-3497 presents notable security risk, a use-after-free vulnerability rated CVSS 7.8. Exploitation could compromise the security of affected deployments. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
GitHub PoC
Exploit-DB