Gstreamer CVE-2023-40475

Despite the high CVSS score of 8.8, the real-world risk is moderated by several factors that create a more nuanced picture. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network-accessible attacks with low complexity but crucially requires user interaction, limiting automated exploitation at scale. The EPSS score of 4.28% places it in the 89th percentile, suggesting above-average but not extreme exploitation likelihood. The vulnerability is not listed in CISA's KEV catalog, indicating no confirmed active exploitation in the wild. While the technical impact is severe (remote code execution), the requirement for user interaction and the availability of patches since the advisory release significantly reduce the practical risk for organizations that maintain regular patching cycles.

An attacker crafts a malicious MXF video file with specially crafted header values designed to trigger the integer overflow in GStreamer's parser, then delivers it to targets through phishing emails, malicious websites, or file-sharing platforms. When a user opens the file in any application using the vulnerable GStreamer library (such as video players, editing software, or web browsers with GStreamer backends), the integer overflow occurs during buffer allocation, allowing the attacker to execute arbitrary code with the privileges of the application. No public proof-of-concept code has been identified, but the straightforward nature of integer overflow vulnerabilities suggests that weaponization would not require advanced expertise.