Gstreamer
CVE-2024-47540
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization checks
|
| Impact | The CVSS 3.1 score of 9.8 reflects the critical nature of this vulnerability with network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N), resulting in high impact to confidentiality, integrity, and availability. The network-accessible, zero-click nature combined with the RCE tag makes this extremely dangerous for exposed services. However, the vulnerability is not listed in CISA KEV catalog and no EPSS score is provided, suggesting limited evidence of active exploitation in the wild. No public proof-of-concept is referenced, though the detailed technical description in the GitHub Security Lab advisory provides sufficient information for weaponization. The primary risk lies in services that automatically process user-uploaded or network-streamed Matroska/WebM content without proper sandboxing. |
| Exploit ScenarioDerived | An attacker crafts a malicious Matroska/WebM file with WavPack audio streams containing headers with size less than 4 bytes, then delivers it to a vulnerable GStreamer-based application via web upload, streaming service, or email attachment. When the application attempts to demux the file, the uninitialized map variable causes the program to jump to an attacker-controlled memory address, achieving remote code execution without any user interaction. Given the low attack complexity and network accessibility, this could be automated for mass exploitation against media processing services. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
An uninitialized stack variable vulnerability in GStreamer's Matroska demuxer leads to function pointer hijacking when processing malformed media files with specific size conditions. The vulnerability affects GStreamer versions prior to 1.24.10 and allows remote attackers to achieve arbitrary code execution without authentication by crafting malicious Matroska/WebM files. With a critical CVSS score of 9.8 and being tagged as RCE, this represents a severe risk for applications using GStreamer for media processing.
RemediationAI
Upgrade GStreamer to version 1.24.10 or later which contains the fix for this vulnerability. The patch is available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch and should be applied immediately for systems processing untrusted media content. For systems that cannot be immediately upgraded, implement strict input validation on media files before processing, run GStreamer processes in sandboxed environments with minimal privileges, and consider disabling Matroska/WebM format support if not required. Monitor the vendor security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0017.html for additional updates.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a widely-used open-source multimedia framework that constructs graphs of media-handling components for audio/video processing. The vulnerability occurs in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c when handling WavPack headers in Matroska container files. This is a classic CWE-457 (Use of Uninitialized Variable) vulnerability where a stack variable 'map' remains uninitialized when the size parameter is less than 4 bytes. The uninitialized map variable is then passed to gst_buffer_unmap, which attempts to dereference function pointers (mem->allocator->mem_unmap_full or mem->allocator->mem_unmap) from the uninitialized memory, allowing attackers to control execution flow. The affected product is identified by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:* for versions before 1.24.10.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size < 4, the program calls gst_buffer_unmap with an uninitialized map variable. Then, in the gst_memory_unmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem->allocator->mem_unmap_full or mem->allocator->mem_unmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10.
Executive ViewAI
Organizations using GStreamer face critical risk from CVE-2024-47540 rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)GitHub Advisory
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
Exploit-DB