Gstreamer
CVE-2024-47607
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Despite the critical CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), real-world exploitation risk appears moderate based on multiple factors. The network attack vector with low complexity and no authentication requirements makes remote exploitation theoretically straightforward. However, the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, suggesting no confirmed active exploitation. No EPSS score or public proof-of-concept code was identified in the intelligence data. The technical impact is severe as it allows full system compromise through arbitrary code execution, but practical exploitation requires an attacker to deliver malicious Opus audio content to a vulnerable GStreamer instance, which may be limited by application-specific constraints and input validation. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability by crafting a malicious Opus audio file or stream with more than 64 audio channels and delivering it to a vulnerable GStreamer-based application through network services, web uploads, or media sharing platforms. When the application attempts to decode the malicious audio, the buffer overflow overwrites the stack return address, allowing the attacker to redirect execution to injected shellcode and gain full control of the system. Given the network attack vector and low complexity, exploitation could be automated to target multiple vulnerable systems simultaneously. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A stack-based buffer overflow vulnerability exists in GStreamer's Opus audio decoder that allows remote attackers to execute arbitrary code by overwriting the instruction pointer (EIP) on the stack. The vulnerability affects all GStreamer versions prior to 1.24.10 and can be triggered when processing specially crafted Opus audio streams with more than 64 channels. While not currently listed in CISA KEV and with no public exploit code identified, the vulnerability has a critical CVSS score of 9.8 due to its remote exploitability without authentication.
RemediationAI
Upgrade GStreamer to version 1.24.10 or later, which contains the official patch for this vulnerability available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8037.patch. Organizations should prioritize patching systems that process untrusted Opus audio content or expose GStreamer-based services to the network. As a temporary mitigation until patching is complete, consider implementing input validation to reject Opus streams with excessive channel counts (over 64) and restricting network access to GStreamer-based services. Monitor the vendor security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0024.html for any additional guidance or updated patches.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a widely-used multimedia framework library for building media processing pipelines, identified by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability occurs in the gst_opus_dec_parse_header function within gstopusdec.c, where a fixed-size stack buffer 'pos' of 64 elements is allocated to store audio channel positions. This is a classic CWE-121 (Stack-based Buffer Overflow) vulnerability where the code fails to validate that n_channels does not exceed the buffer size before entering a loop that writes GST_AUDIO_CHANNEL_POSITION_NONE values. When processing Opus audio with more than 64 channels, the loop writes beyond the buffer boundaries, potentially overwriting critical stack data including the return address.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.
Executive ViewAI
Organizations using GStreamer face critical risk from CVE-2024-47607, a stack-based buffer overflow vulnerability rated CVSS 9.8. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)GitHub Advisory
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
Exploit-DB