Gstreamer
CVE-2024-47600
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Despite the high CVSS score of 9.1, the real-world risk requires nuanced assessment. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) indicates network-exploitable attacks with no authentication required and low complexity, suggesting easy exploitation. However, the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and no EPSS score or public proof-of-concept is mentioned, indicating no observed exploitation in the wild. The attack requires processing specially crafted media files with over 64 audio channels, which limits practical exploitation scenarios. The high availability impact and information disclosure potential make this a priority for media processing applications, particularly those accepting untrusted input, but the lack of integrity impact and specific trigger conditions moderate the immediate risk for most deployments. |
| Exploit ScenarioDerived | An attacker could craft a malicious media file with more than 64 audio channels and host it on a website or send it via email. When a vulnerable GStreamer-based application attempts to analyze or play the file, the out-of-bounds read would expose stack memory contents, potentially revealing sensitive information or causing application crashes. Given the network attack vector and no authentication requirements, exploitation could be automated against web services that process user-uploaded media files, though no public proof-of-concept currently exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A buffer overflow vulnerability in GStreamer's media discovery component allows remote attackers to read sensitive stack memory and potentially crash applications. The flaw occurs when processing media files with more than 64 audio channels, causing the format_channel_mask function to read beyond array bounds. With a CVSS score of 9.1 and network-based attack vector requiring no authentication, this represents a critical risk for applications using GStreamer for media processing, though no active exploitation or public proof-of-concept has been reported.
RemediationAI
Upgrade GStreamer to version 1.24.10 or later, which contains the fix for this vulnerability. The patch is available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8034.patch and can be applied to earlier versions if immediate upgrading is not feasible. Until patching is complete, consider implementing input validation to reject media files with unusually high channel counts (over 64) and restrict processing of untrusted media files. For detailed remediation guidance, refer to the vendor security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0018.html and the GitHub Security Lab advisory at https://securitylab.github.com/advisories/GHSL-2024-248_Gstreamer/.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a widely-used open-source multimedia framework that constructs processing pipelines for audio and video data. The vulnerability (CWE-125: Out-of-bounds Read) exists in the gst-discoverer.c component, specifically in the format_channel_mask function which uses a fixed-size array of 64 elements to process audio channel information. When gst_discoverer_audio_info_get_channels returns a value exceeding 64, the subsequent for loop accesses memory beyond the position array boundaries. The affected CPE identifier cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:* indicates all versions prior to 1.24.10 are vulnerable. This out-of-bounds read can expose stack contents and the subsequent dereference of value->value_nick may lead to further memory corruption.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the format_channel_mask function in gst-discoverer.c. The vulnerability affects the local array position, which is defined with a fixed size of 64 elements. However, the function gst_discoverer_audio_info_get_channels may return a guint channels value greater than 64. This causes the for loop to attempt access beyond the bounds of the position array, resulting in an OOB-read when an index greater than 63 is used. This vulnerability can result in reading unintended bytes from the stack. Additionally, the dereference of value->value_nick after the OOB-read can lead to further memory corruption or undefined behavior. This vulnerability is fixed in 1.24.10.
Executive ViewAI
Organizations using GStreamer face critical risk from CVE-2024-47600, a out-of-bounds read vulnerability rated CVSS 9.1. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)GitHub Advisory
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
Exploit-DB