Gstreamer
CVE-2024-47602
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS 3.1 score of 7.5 (High) reflects the potential for remote, unauthenticated denial of service with no attack complexity, the real-world exploitation risk appears limited. The EPSS score of 0.08% places this in the 23rd percentile, indicating very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog, no public proof-of-concept has been identified, and the attack requires sending maliciously crafted Matroska media files to vulnerable applications. From an SSVC perspective, this represents a denial-of-service-only impact with no evidence of active exploitation, making it a lower priority than the CVSS score suggests. |
| Exploit ScenarioDerived | An attacker could craft a malicious MKV or WebM file with specific codec private data structures that trigger the null pointer dereference when processed by a vulnerable GStreamer application. When a user opens this file in a media player or a server processes it automatically, the application would crash immediately, causing denial of service. No proof-of-concept code has been publicly released, and the attack requires the target to process the malicious file, limiting the attack surface primarily to media processing applications and services. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A null pointer dereference vulnerability in GStreamer's Matroska demuxer can cause application crashes when processing specially crafted media files. The vulnerability affects GStreamer versions prior to 1.24.10 and allows remote attackers to trigger denial of service without authentication. With an EPSS score of only 0.08% and no known active exploitation or public proof-of-concept, this represents a moderate-priority denial of service issue rather than a critical security emergency.
RemediationAI
Upgrade GStreamer to version 1.24.10 or later, which includes the fix for this vulnerability as documented in the vendor patch at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch. For systems that cannot immediately upgrade, consider implementing input validation or sandboxing for applications that process untrusted Matroska/WebM files, though these are imperfect mitigations. Consult the official security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0019.html for additional vendor guidance and the GitHub Security Lab advisory at https://securitylab.github.com/advisories/GHSL-2024-250_Gstreamer/ for technical details.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a widely-used open source multimedia framework for constructing media processing pipelines, identified by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability occurs in the gst_matroska_demux_add_wvpk_header function within the Matroska demultiplexer component, which handles MKV/WebM container formats. The root cause is a missing null pointer check before dereferencing stream->codec_priv, which technically manifests as CWE-125 (Out-of-bounds Read) when GST_READ_UINT16_LE attempts to read from a null address, though the practical impact is a null pointer dereference crash.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. This function does not properly check the validity of the stream->codec_priv pointer in the following code. If stream->codec_priv is NULL, the call to GST_READ_UINT16_LE will attempt to dereference a null pointer, leading to a crash of the application. This vulnerability is fixed in 1.24.10.
Executive ViewAI
Organizations using GStreamer face notable risk from CVE-2024-47602, a out-of-bounds read vulnerability rated CVSS 7.5. Exploitation could compromise the security of affected deployments. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)GitHub Advisory
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
Exploit-DB