Gstreamer CVE-2024-47543

The CVSS score of 7.5 (High) reflects a network-accessible attack (AV:N) with low complexity (AC:L) requiring no privileges (PR:N) or user interaction (UI:N), resulting in high availability impact (A:H). However, real-world risk appears moderate: the EPSS score of 0.08% places this in the 24th percentile, suggesting security researchers assess exploitation probability as low. The vulnerability is not listed in CISA's KEV catalog, indicating no known active exploitation. While a patch exists in merge request 8059, the vulnerability requires an attacker to deliver a malicious media file that gets processed by GStreamer, limiting attack surface compared to pure remote code execution. The primary concern is availability (denial of service) rather than confidentiality breach, despite the potential to read process memory. Organizations using GStreamer for automated media processing from untrusted sources should prioritize patching, while those with controlled input sources face lower immediate risk.

An attacker crafts a malicious QuickTime (.mov) or similar container file with manipulated length values in the metadata atoms. When a victim application processes this file using an unpatched GStreamer library (for example, a media server automatically generating thumbnails, a video conferencing application accepting file uploads, or a content management system processing user-uploaded videos), the qtdemux parser triggers the OOB-read condition, potentially leaking sensitive process memory or causing the application to crash via segmentation fault. The attack requires no user interaction beyond the normal file processing workflow and can be delivered remotely through any media upload or streaming interface.