What is the CVSS score of CVE-2024-47602?

CVE-2024-47602 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Gstreamer are affected by CVE-2024-47602?

Organizations using GStreamer face notable risk from CVE-2024-47602, a out-of-bounds read vulnerability rated CVSS 7.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2024-47602?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Vendor patch is available.

Gstreamer CVE-2024-47602

HIGH

Out-of-bounds Read (CWE-125)

2024-12-12 security-advisories@github.com

Denial Of Service Gstreamer

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:45 vuln.today

Patch released

Mar 17, 2026 - 20:45 nvd

Patch available

CVE Published

Dec 12, 2024 - 02:03 nvd

HIGH 7.5

DescriptionGitHub Advisory

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. This function does not properly check the validity of the stream->codec_priv pointer in the following code. If stream->codec_priv is NULL, the call to GST_READ_UINT16_LE will attempt to dereference a null pointer, leading to a crash of the application. This vulnerability is fixed in 1.24.10.

AnalysisAI

A null pointer dereference vulnerability in GStreamer's Matroska demuxer can cause application crashes when processing specially crafted media files. The vulnerability affects GStreamer versions prior to 1.24.10 and allows remote attackers to trigger denial of service without authentication. With an EPSS score of only 0.08% and no known active exploitation or public proof-of-concept, this represents a moderate-priority denial of service issue rather than a critical security emergency.

Technical ContextAI

GStreamer is a widely-used open source multimedia framework for constructing media processing pipelines, identified by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability occurs in the gst_matroska_demux_add_wvpk_header function within the Matroska demultiplexer component, which handles MKV/WebM container formats. The root cause is a missing null pointer check before dereferencing stream->codec_priv, which technically manifests as CWE-125 (Out-of-bounds Read) when GST_READ_UINT16_LE attempts to read from a null address, though the practical impact is a null pointer dereference crash.

RemediationAI

Upgrade GStreamer to version 1.24.10 or later, which includes the fix for this vulnerability as documented in the vendor patch at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch. For systems that cannot immediately upgrade, consider implementing input validation or sandboxing for applications that process untrusted Matroska/WebM files, though these are imperfect mitigations. Consult the official security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0019.html for additional vendor guidance and the GitHub Security Lab advisory at https://securitylab.github.com/advisories/GHSL-2024-250_Gstreamer/ for technical details.