CVE-2024-47546
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Tags
Description
GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in extract_cc_from_data function within qtdemux.c. In the FOURCC_c708 case, the subtraction atom_length - 8 may result in an underflow if atom_length is less than 8. When that subtraction underflows, *cclen ends up being a large number, and then cclen is passed to g_memdup2 leading to an out-of-bounds (OOB) read. This vulnerability is fixed in 1.24.10.
Analysis
An integer underflow vulnerability in GStreamer's qtdemux component allows remote attackers to trigger out-of-bounds memory reads, potentially causing application crashes or denial of service. The flaw occurs when processing malformed media files with specific atom structures, affecting all GStreamer versions prior to 1.24.10. With an EPSS score of 0.11% and no known active exploitation, this represents a moderate risk primarily for applications processing untrusted media content.
Technical Context
GStreamer is a widely-used open-source multimedia framework (CPE: cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*) that constructs processing graphs for media handling. The vulnerability stems from CWE-191 (Integer Underflow) in the extract_cc_from_data function within qtdemux.c, specifically when handling FOURCC_c708 closed caption data atoms. When atom_length is less than 8, the subtraction atom_length - 8 underflows, resulting in a large value being passed to g_memdup2, which then attempts to read beyond allocated memory boundaries.
Affected Products
GStreamer multimedia framework versions prior to 1.24.10 are vulnerable, as confirmed by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability affects the qtdemux component used for parsing QuickTime and MP4 files. Debian has issued security updates for their LTS distributions as noted in their advisory at https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html. Full details are available in the official GStreamer security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0013.html.
Remediation
Upgrade GStreamer to version 1.24.10 or later, which contains the fix available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch. Organizations unable to immediately patch should implement input validation for media files and consider isolating media processing services in sandboxed environments. Monitor the vendor security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0013.html for additional updates. For systems processing untrusted media, implement resource limits and crash recovery mechanisms to mitigate potential denial of service impacts.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today