Gstreamer
CVE-2024-47598
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 9.1 indicates critical severity with network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N), resulting in high confidentiality and availability impact. However, the real-world risk appears moderate as there is no evidence of active exploitation (not in CISA KEV), no known public proof-of-concept, and the vulnerability is limited to reading only 4 bytes of memory. The network-based attack vector requires an attacker to serve malicious media files that would be processed by vulnerable GStreamer instances. While the high CVSS score reflects the theoretical impact, the practical exploitation difficulty and limited data exposure suggest this is a priority for systems actively processing untrusted media content but may be less critical for closed systems. |
| Exploit ScenarioDerived | An attacker could craft a malicious QuickTime or MP4 media file with specially formatted stts table data and host it on a web server or distribute it through file-sharing platforms. When a vulnerable GStreamer-based application processes this file, it would trigger the out-of-bounds read, potentially exposing 4 bytes of adjacent memory which could contain sensitive information or cause application instability. Given the network attack vector and no authentication requirements, this could be automated at scale against internet-facing media processing services. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
An out-of-bounds read vulnerability exists in GStreamer's qtdemux component that allows reading 4 bytes beyond allocated memory boundaries when processing media files. The vulnerability affects GStreamer versions prior to 1.24.10 and can be exploited remotely without authentication to potentially expose sensitive information or cause application crashes. With a CVSS score of 9.1 and network-based attack vector, this represents a significant risk for applications using GStreamer for media processing, though no active exploitation or public proof-of-concept has been reported.
RemediationAI
Upgrade GStreamer to version 1.24.10 or later, which contains the fix for this vulnerability. The patch is available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059.patch and should be applied immediately for systems processing untrusted media content. For systems that cannot immediately upgrade, consider implementing input validation and sandboxing for media processing operations, restricting the processing of QuickTime/MP4 files from untrusted sources, or isolating GStreamer-based applications in controlled environments with limited access to sensitive data.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a multimedia framework library used for constructing graphs of media-handling components, commonly employed in video players, streaming applications, and media processing tools. The vulnerability (CWE-125: Out-of-bounds Read) occurs in the qtdemux_merge_sample_table function within qtdemux.c, specifically when processing QuickTime/MP4 demuxing operations. The affected products are identified by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:* for all versions prior to 1.24.10, where insufficient bounds checking on the stts (sample-to-time-sample) buffer allows reading of stts_duration values beyond the allocated memory region.
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in the qtdemux_merge_sample_table function within qtdemux.c. The problem is that the size of the stts buffer isn’t properly checked before reading stts_duration, allowing the program to read 4 bytes beyond the boundaries of stts->data. This vulnerability reads up to 4 bytes past the allocated bounds of the stts array. This vulnerability is fixed in 1.24.10.
Executive ViewAI
Organizations using GStreamer face critical risk from CVE-2024-47598, a out-of-bounds read vulnerability rated CVSS 9.1. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)GitHub Advisory
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
Exploit-DB