Gstreamer
CVE-2024-47541
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS score of 7.5 (High) reflects a network-accessible attack vector with low complexity requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), but the impact is limited to availability (A:H) with no confidentiality or integrity compromise. However, real-world risk appears moderate when triangulating multiple signals: the EPSS score of 0.09% (25th percentile) suggests minimal active exploitation despite public POC availability from GitHub Security Lab. The attack is network-exploitable and automatable through maliciously crafted subtitle files, but requires the victim to process untrusted SSA subtitle content. The availability of both patches and working exploits makes this a medium-priority issue for systems processing external media content, particularly streaming servers or media players, but less critical than actively exploited vulnerabilities. Organizations using GStreamer in trusted, controlled environments face lower immediate risk. |
| Exploit ScenarioDerived | An attacker hosts a malicious media file with specially crafted SSA subtitle track containing mismatched curly brackets (closing bracket before opening bracket) on a streaming server or file-sharing platform. When a victim's GStreamer-based media player or server-side transcoding service processes this file, the malformed subtitle triggers the out-of-bounds write in gst_ssa_parse_remove_override_codes, causing memory corruption that crashes the application and denies service. The attack requires low complexity as demonstrated by the available POC from GitHub Security Lab (https://securitylab.github.com/advisories/GHSL-2024-228_GStreamer/), and can be delivered through any network channel that delivers media content to GStreamer processors. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
An out-of-bounds write vulnerability exists in GStreamer's SSA subtitle parser (gstssaparse.c) that occurs when malformed SubStation Alpha style override codes contain a closing curly bracket before an opening bracket. This triggers progressively larger memory writes via memmove(), leading to memory corruption and denial of service. A public proof-of-concept exploit is available from GitHub Security Lab (GHSL-2024-228), though the EPSS score remains relatively low at 0.09% (25th percentile), indicating limited observed exploitation activity in the wild.
RemediationAI
Upgrade GStreamer to version 1.24.10 or later, which contains the fix for this vulnerability as documented in the official security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0023.html. The specific patch code is available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8036.patch for review or backporting purposes. Until patching is feasible, implement defense-in-depth measures including restricting GStreamer-based applications from processing untrusted subtitle files from external sources, employing application sandboxing or containerization to limit exploit impact, and disabling SSA subtitle parsing if not required for operational purposes. Linux distribution users should apply vendor-provided security updates through their package managers as they become available.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a widely-used multimedia framework library for constructing media-handling pipelines, commonly deployed in Linux distributions, embedded systems, and desktop applications. The vulnerability affects the SSA (SubStation Alpha) subtitle format parser in the gstssaparse.c component, specifically within the gst_ssa_parse_remove_override_codes function responsible for parsing style override codes enclosed in curly brackets. This is classified as CWE-787 (Out-of-bounds Write), where improper validation of bracket ordering causes memmove() to be called with progressively increasing length parameters (strlen(end+1)) on each iteration, writing beyond allocated heap boundaries. The CPE identifier cpe:2.3:a:gstreamer:gstreamer confirms this affects the core GStreamer library.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
GStreamer is a library for constructing graphs of media-handling components. An OOB-write vulnerability has been identified in the gst_ssa_parse_remove_override_codes function of the gstssaparse.c file. This function is responsible for parsing and removing SSA (SubStation Alpha) style override codes, which are enclosed in curly brackets ({}). The issue arises when a closing curly bracket "}" appears before an opening curly bracket "{" in the input string. In this case, memmove() incorrectly duplicates a substring. With each successive loop iteration, the size passed to memmove() becomes progressively larger (strlen(end+1)), leading to a write beyond the allocated memory bounds. This vulnerability is fixed in 1.24.10.
Executive ViewAI
Organizations using GStreamer face notable risk from CVE-2024-47541, a out-of-bounds write vulnerability rated CVSS 7.5. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. Proof-of-concept code is publicly available, increasing the risk of exploitation. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)GitHub Advisory
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
Exploit-DB