What is the CVSS score of CVE-2024-47538?

CVE-2024-47538 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Gstreamer are affected by CVE-2024-47538?

Organizations using GStreamer face critical risk from CVE-2024-47538, a stack-based buffer overflow vulnerability rated CVSS 9.8.. A patch is available.

How to fix or mitigate CVE-2024-47538?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. If patching is delayed, consider network segmentation to limit exposure.

Gstreamer CVE-2024-47538

CRITICAL

Stack-based Buffer Overflow (CWE-121)

2024-12-12 security-advisories@github.com

Buffer Overflow Gstreamer

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:45 vuln.today

Patch released

Mar 17, 2026 - 20:45 nvd

Patch available

CVE Published

Dec 12, 2024 - 02:03 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the vorbis_handle_identification_packet function within gstvorbisdec.c. The position array is a stack-allocated buffer of size 64. If vd->vi.channels exceeds 64, the for loop will write beyond the boundaries of the position array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This vulnerability allows someone to overwrite the EIP address allocated in the stack. Additionally, this bug can overwrite the GstAudioInfo info structure. This vulnerability is fixed in 1.24.10.

AnalysisAI

A stack buffer overflow vulnerability exists in GStreamer's Vorbis audio decoder that allows remote attackers to execute arbitrary code without authentication. The flaw occurs when processing malicious Vorbis audio files with more than 64 channels, leading to stack memory corruption and potential control over the instruction pointer (EIP). While not currently in CISA's Known Exploited Vulnerabilities catalog, the vulnerability has a critical CVSS score of 9.8 and patches are available.

Technical ContextAI

GStreamer is a widely-used open source multimedia framework for constructing media processing pipelines, identified by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability manifests as a classic stack buffer overflow (CWE-121) in the vorbis_handle_identification_packet function within gstvorbisdec.c, where a fixed-size stack array of 64 elements is overflowed when processing Vorbis audio streams claiming to have more than 64 channels. This allows attackers to overwrite critical stack data including the return address and the GstAudioInfo structure, potentially leading to arbitrary code execution in the context of the application using GStreamer.

RemediationAI

Upgrade GStreamer to version 1.24.10 or later, which contains the fix for this vulnerability. The patch is available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8035.patch and should be applied immediately for systems processing untrusted media content. Until patching is possible, implement strict input validation to reject Vorbis files claiming more than 64 audio channels, isolate media processing services in sandboxed environments, and avoid processing untrusted media files in security-sensitive contexts. Organizations should reference the official security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0022.html for comprehensive patching guidance.