CVE-2023-37328
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Tags
Description
GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of PGS subtitle files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-20994.
Analysis
A heap-based buffer overflow vulnerability in GStreamer's PGS (Presentation Graphic Stream) subtitle file parser allows remote attackers to execute arbitrary code when processing malicious subtitle files. The vulnerability affects all GStreamer installations and requires user interaction to exploit, typically by opening a media file with crafted PGS subtitles. With an EPSS score of 7.71% (92nd percentile), this vulnerability represents a significant exploitation risk in the wild.
Technical Context
GStreamer is a widely-used open-source multimedia framework that handles audio and video processing across numerous applications and platforms. The vulnerability resides in the PGS subtitle parsing component, where insufficient validation of user-supplied data length leads to a heap buffer overflow (CWE-122). According to the CPE data (cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*), all versions of GStreamer are affected. PGS subtitles are commonly used in Blu-ray discs and digital media files, making this a broad attack surface for multimedia applications using GStreamer.
Affected Products
All versions of GStreamer are affected by this vulnerability according to the CPE identifiers (cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*). The GStreamer project has published security advisory SA-2023-0003 at https://gstreamer.freedesktop.org/security/sa-2023-0003.html detailing the impact. Fedora Linux has also issued security updates as documented at https://lists.fedoraproject.org/archives/list/[email protected]/message/IGQEFZ6ZB3C2XU4JQD3IAFMQIN456W2D/. The Zero Day Initiative advisory is available at https://www.zerodayinitiative.com/advisories/ZDI-23-901/.
Remediation
Update GStreamer to the latest patched version as specified in security advisory SA-2023-0003 at https://gstreamer.freedesktop.org/security/sa-2023-0003.html. For Fedora users, apply the security updates referenced at https://lists.fedoraproject.org/archives/list/[email protected]/message/IGQEFZ6ZB3C2XU4JQD3IAFMQIN456W2D/. As an immediate mitigation, disable PGS subtitle processing or restrict media file sources to trusted origins only. Organizations should inventory all applications using GStreamer libraries and prioritize patching based on exposure to untrusted media files.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today