Gstreamer CVE-2023-40476

This vulnerability presents a significant real-world risk with a CVSS score of 8.8 (High) driven by network-based attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:R). The EPSS score of 6.22% places it in the 91st percentile, indicating substantially higher exploitation likelihood than most CVEs. While not currently listed in CISA's KEV catalog suggesting no confirmed active exploitation, the combination of remote code execution capability, widespread usage of GStreamer, and the relatively straightforward exploitation path (malicious video file) makes this a priority for patching. The requirement for user interaction somewhat mitigates the risk compared to unauthenticated network services, but given that video processing often happens automatically in many contexts (thumbnails, previews, messaging apps), the attack surface remains substantial.

An attacker crafts a malicious H265-encoded video file with specially formatted data that triggers the buffer overflow when parsed by GStreamer, then distributes it through common vectors like email attachments, messaging platforms, or malicious websites. When a user opens the video file or when an application automatically processes it (for thumbnail generation or preview), the overflow occurs, allowing the attacker to execute arbitrary code with the privileges of the application processing the video. The Zero Day Initiative advisory at https://www.zerodayinitiative.com/advisories/ZDI-23-1458/ provides additional technical details about the vulnerability.