Gstreamer
CVE-2023-44446
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 8.8 (High) reflects significant severity with network-based attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:R), indicating this is a client-side attack requiring victim action. The EPSS score of 4.17% places this vulnerability in the 89th percentile, suggesting above-average exploitation likelihood compared to other CVEs, though not extreme. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept has been referenced, suggesting limited active exploitation in the wild. The combination of requiring user interaction and the availability of patches since the advisory release moderates the real-world risk, making this a priority for environments processing untrusted media files but not a critical emergency for most deployments. |
| Exploit ScenarioDerived | An attacker crafts a malicious MXF video file that triggers the use-after-free condition when parsed by GStreamer, then distributes it through email attachments, file-sharing platforms, or compromised media streaming services. When a user opens or streams the malicious file through any application using GStreamer (such as media players, video editors, or streaming servers), the vulnerability allows the attacker to execute arbitrary code with the privileges of the running application. The attack requires minimal sophistication due to low complexity but depends on convincing users to interact with the malicious media file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A use-after-free vulnerability in GStreamer's MXF (Material Exchange Format) video file parser allows remote attackers to execute arbitrary code when processing specially crafted MXF files. The vulnerability affects all GStreamer installations and requires user interaction such as opening a malicious video file, with an EPSS score of 4.17% indicating moderate real-world exploitation likelihood. While not currently in CISA's KEV catalog, the vulnerability has a patch available and was discovered through responsible disclosure by the Zero Day Initiative.
RemediationAI
Apply the vendor-provided patches detailed in GStreamer Security Advisory SA-2023-0010 available at https://gstreamer.freedesktop.org/security/sa-2023-0010.html, which contains fixes for the MXF parser use-after-free vulnerability. Until patching is complete, implement input validation to restrict processing of MXF files from untrusted sources and consider disabling MXF format support if not required for business operations. Organizations should also monitor the Zero Day Initiative advisory at https://www.zerodayinitiative.com/advisories/ZDI-23-1647/ for any updates or additional technical details about the vulnerability.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a widely-used open-source multimedia framework that provides a pipeline-based architecture for building media-handling components, affected across all versions as indicated by the CPE string cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability stems from a use-after-free condition (CWE-416) in the MXF demuxer component, where the parser fails to properly validate object existence before performing operations on potentially freed memory. This memory corruption class of vulnerability occurs when code attempts to access memory that has already been deallocated, potentially allowing attackers to control the freed memory space and achieve code execution in the context of the application using GStreamer.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
GStreamer MXF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the parsing of MXF video files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22299.
Executive ViewAI
CVE-2023-44446 presents significant security risk, a use-after-free vulnerability rated CVSS 8.8. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
GitHub PoC
Exploit-DB