Gstreamer CVE-2024-47542

The CVSS v3.1 score of 7.5 (High severity) reflects the ease of exploitation with network attack vector, low complexity, and no required privileges or user interaction (AV:N/AC:L/PR:N/UI:N). However, the impact is limited to availability (A:H) with no confidentiality or integrity consequences. The low EPSS score of 0.08% suggests minimal observed exploitation interest despite public POC availability, likely because the impact is limited to DoS rather than code execution or data exfiltration. From an SSVC perspective, exploitation is proven (POC exists), the attack is automatable (malicious media files can be delivered via web or email), but technical impact is limited to service disruption. This makes it a moderate real-world priority—important for public-facing media processing services but not critical compared to RCE vulnerabilities. Organizations processing untrusted media streams should prioritize patching.

An attacker crafts a malicious audio file (such as MP3) with a specially malformed ID3v2 tag structure designed to trigger the null pointer dereference when the frame_data field is missing. When a victim application using vulnerable GStreamer processes this file—either through direct user upload, automated media ingestion pipelines, or streaming media services—the id3v2_read_synch_uint function crashes with a segmentation fault, causing immediate service disruption. The attack requires no authentication and can be automated by submitting malicious files to public-facing media processing endpoints, as demonstrated in the GitHub Security Lab proof-of-concept (GHSL-2024-235).