Gstreamer CVE-2021-3522

The risk assessment presents a mixed signal profile. The CVSS 3.1 score of 5.5 reflects moderate severity: local attack vector (AV:L) with low complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), and impact limited to availability (A:H with no confidentiality or integrity impact). However, the EPSS score of 0.13% (32nd percentile) indicates this vulnerability has very low probability of real-world exploitation, placing it below the median for exploitability. No KEV status or active exploitation has been reported in available intelligence. The patch availability from the vendor and multiple security advisories (Red Hat, NetApp October 2021, Oracle October 2021, Gentoo) demonstrate vendor coordination, suggesting this was responsibly disclosed. The requirement for user interaction (opening a malicious audio file) further reduces practical attack surface. SSVC analysis would rate this as: Exploitation Unproven (no public POC identified), manually triggered (not automatable at scale), with limited technical impact (denial of service only). This is a real but low-priority issue—patch when possible but not an emergency.

An attacker sends a target user a crafted MP3 or audio file with a malicious ID3v2 tag containing oversized or invalid frame descriptors via email or file-sharing service. When the user opens the file in a media player, email client, or system indexer that uses GStreamer (or when a NetApp admin ingests audio telemetry), the vulnerable parser attempts to read tag metadata beyond the allocated buffer boundary. This triggers a denial of service, either crashing the application or potentially exposing adjacent memory contents. The local attack vector and user interaction requirement mean this is not wormable or remotely triggerable without social engineering, limiting mass-exploitation scenarios. No public POC or in-the-wild exploitation has been documented, keeping real-world risk low despite technical feasibility.