Gstreamer
CVE-2024-47601
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS score of 7.5 (High severity) reflects network-based attack vector with low complexity and no authentication requirements (AV:N/AC:L/PR:N/UI:N), though impact is limited to availability (A:H). However, real-world exploitation risk appears moderate rather than critical: the EPSS score of 0.10% indicates only a 1-in-1000 probability of exploitation in the wild within 30 days, placing it in the 28th percentile. The vulnerability requires user interaction to process a malicious media file, despite the CVSS UI:N rating suggesting otherwise for typical deployment scenarios. With patches available and no evidence of active exploitation, this represents a manageable denial-of-service risk rather than an urgent critical threat. Organizations should prioritize patching based on exposure of GStreamer-based applications to untrusted media sources, particularly web-facing media processing services. |
| Exploit ScenarioDerived | An attacker crafts a malicious Matroska (.mkv or .webm) media file with specially formed blockgroup or simpleblock structures designed to trigger the null pointer dereference. When a user opens this file in any GStreamer-based application (media players, streaming services, transcoding tools), or when an automated media processing service ingests the file, the demuxer crashes, causing denial of service. Proof-of-concept details are publicly available through the GitHub Security Lab advisory, lowering the technical barrier for exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A null pointer dereference vulnerability exists in GStreamer's Matroska demuxer component, specifically in the gst_matroska_demux_parse_blockgroup_or_simpleblock function. GStreamer versions prior to 1.24.10 are affected, allowing remote attackers to cause denial of service by sending specially crafted Matroska (MKV) media files without authentication. With an EPSS score of 0.10% (28th percentile), exploitation probability is currently low, though proof-of-concept details are publicly available through GitHub Security Lab.
RemediationAI
Upgrade GStreamer to version 1.24.10 or later to address this vulnerability, as documented in the official security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0020.html. The fix is available through the upstream patch at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch. Debian users should apply updates referenced in https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html. As an interim mitigation, restrict processing of Matroska media files to trusted sources only, implement input validation and sanitization for media files before processing, and consider sandboxing GStreamer-based applications to limit the impact of denial-of-service crashes. Monitor for abnormal application terminations that may indicate exploitation attempts.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a widely-used multimedia framework (cpe:2.3:a:gstreamer:gstreamer) that provides a pipeline-based architecture for constructing media processing workflows. The vulnerability resides in matroska-demux.c, which handles parsing of Matroska container format files (commonly .mkv, .webm). The issue is classified as CWE-476 (NULL Pointer Dereference), where the gst_matroska_demux_parse_blockgroup_or_simpleblock function fails to validate the GstBuffer *sub pointer before dereferencing it. When processing malformed Matroska files, this missing validation allows the pointer to remain null during dereference operations, triggering a crash in the demuxer component and terminating the media processing pipeline.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_parse_blockgroup_or_simpleblock function within matroska-demux.c. This function does not properly check the validity of the GstBuffer *sub pointer before performing dereferences. As a result, null pointer dereferences may occur. This vulnerability is fixed in 1.24.10.
Executive ViewAI
Organizations using GStreamer face notable risk from CVE-2024-47601, a null pointer dereference vulnerability rated CVSS 7.5. Exploitation could compromise the security of affected deployments. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)GitHub Advisory
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
Exploit-DB