Gstreamer
CVE-2023-38103
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a significant real-world risk with a CVSS score of 8.8 (High) characterized by network-based attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:R). The EPSS score of 4.54% places it in the 89th percentile, indicating above-average exploitation probability compared to other CVEs. While not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, the combination of remote code execution capability, availability of detailed technical information from ZDI-CAN-21443, and the widespread use of GStreamer makes this a priority for patching. The requirement for user interaction (opening a malicious file or visiting a website with embedded media) somewhat reduces the risk compared to fully automated attacks, but given GStreamer's integration in browsers, media players, and streaming applications, the attack surface remains substantial. |
| Exploit ScenarioDerived | An attacker crafts a malicious RealMedia file with specially manipulated MDPR chunk size values designed to trigger an integer overflow during parsing. When a user opens this file in any application using the vulnerable GStreamer library (such as a media player or web browser), the overflow occurs during buffer allocation, allowing the attacker to execute arbitrary code with the privileges of the application. Given the low attack complexity and the fact that RealMedia files can be embedded in websites or distributed through various channels, this represents a practical attack vector for targeted or widespread campaigns. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A critical integer overflow vulnerability exists in GStreamer's RealMedia file parser that allows remote code execution when processing specially crafted MDPR chunks. The vulnerability affects GStreamer version 1.22.3 and potentially earlier versions, enabling attackers to execute arbitrary code in the context of the current process through maliciously crafted RealMedia files. With an EPSS score of 4.54% (89th percentile), this vulnerability has a higher-than-average likelihood of exploitation in the wild, though it requires user interaction to trigger.
RemediationAI
Apply the official patch available from the GStreamer project at https://gitlab.freedesktop.org/gstreamer/gstreamer/uploads/d4a0aa4ec2165f6c418703b9e1459d8b/0002-rmdemux-Check-for-integer-overflow-when-calculation-.patch which adds proper integer overflow checks to the MDPR chunk parsing code. Organizations should update to the latest patched version of GStreamer as soon as possible. Until patching is complete, consider implementing network-level controls to block or inspect RealMedia files, restricting access to untrusted media sources, and educating users about the risks of opening media files from unknown sources. For additional details, refer to the Zero Day Initiative advisory at https://www.zerodayinitiative.com/advisories/ZDI-23-1007/.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a widely-used open-source multimedia framework that processes various media formats including RealMedia files. The vulnerability (CWE-190: Integer Overflow or Wraparound) occurs specifically during the parsing of MDPR (Media Properties) chunks within RealMedia files, where insufficient validation of user-supplied size values can cause an integer overflow before buffer allocation. The affected product is identified through CPE as cpe:2.3:a:gstreamer:gstreamer:1.22.3:*:*:*:*:*:*:*, indicating the core GStreamer library is vulnerable. This type of vulnerability is particularly dangerous in media processing libraries as they commonly handle untrusted input from various sources including web content, streaming services, and local files.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the parsing of MDPR chunks. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21443.
Executive ViewAI
CVE-2023-38103 presents significant security risk, a integer overflow vulnerability rated CVSS 8.8. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
GitHub PoC
Exploit-DB