Gstreamer
CVE-2024-47537
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a critical real-world risk with multiple indicators supporting immediate prioritization. The CVSS 3.1 score of 9.8 reflects network-based exploitation (AV:N) with low complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N), achieving high impact across confidentiality, integrity, and availability. The integer overflow leading to heap corruption is a well-understood attack primitive that enables arbitrary code execution. While no EPSS score or KEV listing is mentioned in the provided data, the combination of remote exploitability, no authentication requirements, and the widespread use of GStreamer in media processing applications makes this a high-priority patch. The vulnerability is particularly concerning for web applications, media servers, and any service that processes untrusted media files using GStreamer. |
| Exploit ScenarioDerived | An attacker crafts a malicious QuickTime media file with an extremely large samples_count value designed to trigger the integer overflow when added to existing sample counts. When a vulnerable GStreamer-based application processes this file over the network (such as a media streaming service or web application), the overflow causes heap memory corruption allowing the attacker to overwrite critical data structures and achieve remote code execution without any authentication or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
An integer overflow vulnerability in GStreamer's QuickTime demuxer leads to out-of-bounds memory writes when processing malicious media files with crafted sample count values. The vulnerability affects all GStreamer versions prior to 1.24.10 and allows remote attackers to achieve arbitrary code execution without authentication by serving specially crafted media files. With a critical CVSS score of 9.8 and network-based attack vector, this presents a severe risk for applications using GStreamer for media processing.
RemediationAI
Upgrade GStreamer to version 1.24.10 or later which contains the fix for this vulnerability. The patch is available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch and has been incorporated into the 1.24.10 release. For systems that cannot immediately upgrade, consider implementing input validation or sandboxing for any services that process untrusted media files with GStreamer. Organizations should review the vendor security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0005.html for additional details and ensure all GStreamer installations across their infrastructure are updated, particularly those exposed to untrusted input.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a widely-used multimedia framework library for constructing graphs of media-handling components, identified by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability stems from CWE-190 (Integer Overflow or Wraparound) in the QuickTime demuxer component where the program attempts to reallocate memory for stream->samples based on untrusted input. When processing QuickTime files, the demuxer reads a samples_count value directly from the input file and adds it to stream->n_samples without proper bounds checking. If samples_count is sufficiently large, the addition operation overflows, causing g_try_renew to allocate far less memory than required. The subsequent loop then writes samples_count elements to this undersized buffer, resulting in heap corruption.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream->samples to accommodate stream->n_samples + samples_count elements of type QtDemuxSample. The problem is that samples_count is read from the input file. And if this value is big enough, this can lead to an integer overflow during the addition. As a consequence, g_try_renew might allocate memory for a significantly smaller number of elements than intended. Following this, the program iterates through samples_count elements and attempts to write samples_count number of elements, potentially exceeding the actual allocated memory size and causing an OOB-write. This vulnerability is fixed in 1.24.10.
Executive ViewAI
Organizations using GStreamer face critical risk from CVE-2024-47537, a integer overflow vulnerability rated CVSS 9.8. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)GitHub Advisory
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
Exploit-DB