Gstreamer
CVE-2024-47544
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 7.5 (High) reflects a network-exploitable vulnerability requiring no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), but the impact is limited to availability (A:H) with no confidentiality or integrity impact. The EPSS score of 0.10% (28th percentile) suggests very low real-world exploitation likelihood, and the vulnerability is not listed in CISA KEV catalog indicating no known active exploitation. The combination of remote exploitability but denial-of-service-only impact, coupled with the requirement for an attacker to deliver specially crafted media files to vulnerable applications, positions this as a medium-priority issue for most organizations. The availability of patches and the specialized attack requirement (malformed media files) further reduce practical risk compared to the theoretical CVSS score. |
| Exploit ScenarioDerived | An attacker could craft a malicious QuickTime or MP4 file with specially malformed sample grouping boxes that trigger the null pointer dereference when processed by a vulnerable GStreamer application. When a media player, transcoding service, or streaming application using GStreamer attempts to parse this file, it would crash due to the null pointer access, resulting in service disruption. No proof-of-concept code is publicly available according to the references, but the straightforward nature of null dereference bugs suggests exploitation would be trivial for attackers with media format knowledge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A null pointer dereference vulnerability exists in the GStreamer multimedia framework's qtdemux_parse_sbgp function, allowing remote attackers to cause denial of service through crafted media files. The vulnerability affects all GStreamer versions prior to 1.24.10 and can be triggered without authentication when processing malicious QuickTime/MP4 files. With an EPSS score of 0.10% and no known KEV listing, this represents a moderate stability risk primarily relevant for applications processing untrusted media content.
RemediationAI
Upgrade GStreamer to version 1.24.10 or later, which contains the fix for this vulnerability. The patch is available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch and should be applied through your distribution's package manager or by building from source. For systems that cannot immediately upgrade, implement input validation for media files before processing with GStreamer applications, restrict processing of untrusted media content, and consider running GStreamer-based services in isolated environments with resource limits to minimize denial of service impact. Consult the official security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0011.html for additional vendor guidance.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a pipeline-based multimedia framework that links together a wide variety of media processing systems to complete complex workflows. The vulnerability specifically affects the QuickTime demuxer component (qtdemux.c) which is responsible for parsing QuickTime and MP4 container formats. According to the CPE identifier (cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*), all versions of GStreamer prior to 1.24.10 are affected. The CWE-476 classification indicates this is a NULL pointer dereference bug, occurring when the qtdemux_parse_sbgp function attempts to access memory through a null pointer, likely due to insufficient validation of input data structures when parsing sample grouping boxes in media files.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
GStreamer is a library for constructing graphs of media-handling components. The function qtdemux_parse_sbgp in qtdemux.c is affected by a null dereference vulnerability. This vulnerability is fixed in 1.24.10.
Executive ViewAI
Organizations using GStreamer face notable risk from CVE-2024-47544, a null pointer dereference vulnerability rated CVSS 7.5. Exploitation could compromise the security of affected deployments. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)GitHub Advisory
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
Exploit-DB