CVE-2024-47602
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Description
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. This function does not properly check the validity of the stream->codec_priv pointer in the following code. If stream->codec_priv is NULL, the call to GST_READ_UINT16_LE will attempt to dereference a null pointer, leading to a crash of the application. This vulnerability is fixed in 1.24.10.
Analysis
A null pointer dereference vulnerability in GStreamer's Matroska demuxer can cause application crashes when processing specially crafted media files. The vulnerability affects GStreamer versions prior to 1.24.10 and allows remote attackers to trigger denial of service without authentication. With an EPSS score of only 0.08% and no known active exploitation or public proof-of-concept, this represents a moderate-priority denial of service issue rather than a critical security emergency.
Technical Context
GStreamer is a widely-used open source multimedia framework for constructing media processing pipelines, identified by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability occurs in the gst_matroska_demux_add_wvpk_header function within the Matroska demultiplexer component, which handles MKV/WebM container formats. The root cause is a missing null pointer check before dereferencing stream->codec_priv, which technically manifests as CWE-125 (Out-of-bounds Read) when GST_READ_UINT16_LE attempts to read from a null address, though the practical impact is a null pointer dereference crash.
Affected Products
GStreamer versions prior to 1.24.10 are affected by this vulnerability, as confirmed by the CPE identifier cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability specifically impacts applications using GStreamer's Matroska demuxer component to process MKV or WebM files. Debian LTS has issued an update according to their security announcement at https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html. The official GStreamer security advisory is available at https://gstreamer.freedesktop.org/security/sa-2024-0019.html.
Remediation
Upgrade GStreamer to version 1.24.10 or later, which includes the fix for this vulnerability as documented in the vendor patch at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch. For systems that cannot immediately upgrade, consider implementing input validation or sandboxing for applications that process untrusted Matroska/WebM files, though these are imperfect mitigations. Consult the official security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0019.html for additional vendor guidance and the GitHub Security Lab advisory at https://securitylab.github.com/advisories/GHSL-2024-250_Gstreamer/ for technical details.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today