CVE-2023-40475
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of MXF video files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-21661.
Analysis
A critical integer overflow vulnerability in GStreamer's MXF (Material Exchange Format) video file parser allows remote attackers to execute arbitrary code on affected systems. The vulnerability affects all versions of GStreamer prior to the patched releases and requires user interaction (opening a malicious MXF file) to exploit, with an EPSS score of 4.28% indicating moderate real-world exploitation likelihood. While not currently listed in CISA's Known Exploited Vulnerabilities catalog, the vulnerability has a high CVSS score of 8.8 and patches are available from the vendor.
Technical Context
GStreamer is a widely-used open-source multimedia framework that provides a pipeline-based architecture for handling audio and video playback, streaming, and editing across multiple platforms. The vulnerability specifically resides in the MXF demuxer component responsible for parsing Material Exchange Format files, a professional video container format commonly used in broadcast and post-production workflows. The root cause is CWE-190 (Integer Overflow or Wraparound), where inadequate validation of user-supplied data in MXF file headers can cause an integer overflow during buffer size calculations, leading to heap buffer overflows when the undersized buffer is subsequently used.
Affected Products
All versions of GStreamer prior to the patched releases are affected by this vulnerability, as indicated by the CPE identifier cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability was originally tracked as ZDI-CAN-21661 by Trend Micro's Zero Day Initiative before public disclosure. Debian has also issued security updates for their GStreamer packages as documented in their security announcement at https://lists.debian.org/debian-lts-announce/2023/10/msg00038.html, indicating the widespread distribution impact across Linux systems.
Remediation
Organizations should immediately update GStreamer to the latest patched version as detailed in the official security advisory at https://gstreamer.freedesktop.org/security/sa-2023-0007.html. For systems where immediate patching is not feasible, implement compensating controls by restricting the processing of untrusted MXF files, employing sandboxing for media processing applications, and ensuring that GStreamer-based applications run with minimal privileges. Additionally, monitor the Zero Day Initiative advisory at https://www.zerodayinitiative.com/advisories/ZDI-23-1457/ for any updates or additional technical details about the vulnerability.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today