What is the CVSS score of CVE-2023-44446?

CVE-2023-44446 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 4.2%.

Which versions of Gstreamer are affected by CVE-2023-44446?

CVE-2023-44446 presents significant security risk, a use-after-free vulnerability rated CVSS 8.8.. A patch is available.

How to fix or mitigate CVE-2023-44446?

Within 7 days: Identify all affected systems and apply vendor patches promptly. If patching is delayed, consider network segmentation to limit exposure.

Gstreamer CVE-2023-44446

HIGH

Use After Free (CWE-416)

2024-05-03 zdi-disclosures@trendmicro.com

RCE Gstreamer

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:45 vuln.today

Patch released

Mar 17, 2026 - 20:45 nvd

Patch available

CVE Published

May 03, 2024 - 03:16 nvd

HIGH 8.8

DescriptionCVE.org

GStreamer MXF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of MXF video files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22299.

AnalysisAI

A use-after-free vulnerability in GStreamer's MXF (Material Exchange Format) video file parser allows remote attackers to execute arbitrary code when processing specially crafted MXF files. The vulnerability affects all GStreamer installations and requires user interaction such as opening a malicious video file, with an EPSS score of 4.17% indicating moderate real-world exploitation likelihood. While not currently in CISA's KEV catalog, the vulnerability has a patch available and was discovered through responsible disclosure by the Zero Day Initiative.

Technical ContextAI

GStreamer is a widely-used open-source multimedia framework that provides a pipeline-based architecture for building media-handling components, affected across all versions as indicated by the CPE string cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability stems from a use-after-free condition (CWE-416) in the MXF demuxer component, where the parser fails to properly validate object existence before performing operations on potentially freed memory. This memory corruption class of vulnerability occurs when code attempts to access memory that has already been deallocated, potentially allowing attackers to control the freed memory space and achieve code execution in the context of the application using GStreamer.

RemediationAI

Apply the vendor-provided patches detailed in GStreamer Security Advisory SA-2023-0010 available at https://gstreamer.freedesktop.org/security/sa-2023-0010.html, which contains fixes for the MXF parser use-after-free vulnerability. Until patching is complete, implement input validation to restrict processing of MXF files from untrusted sources and consider disabling MXF format support if not required for business operations. Organizations should also monitor the Zero Day Initiative advisory at https://www.zerodayinitiative.com/advisories/ZDI-23-1647/ for any updates or additional technical details about the vulnerability.