CVE-2024-47776
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
3Description
GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in gst_wavparse_cue_chunk within gstwavparse.c. The vulnerability happens due to a discrepancy between the size of the data buffer and the size value provided to the function. This mismatch causes the comparison if (size < 4 + ncues * 24) to fail in some cases, allowing the subsequent loop to access beyond the bounds of the data buffer. The root cause of this discrepancy stems from a miscalculation when clipping the chunk size based on upstream data size. This vulnerability allows reading beyond the bounds of the data buffer, potentially leading to a crash (denial of service) or the leak of sensitive data. This vulnerability is fixed in 1.24.10.
Analysis
An out-of-bounds read vulnerability exists in GStreamer's WAV file parser that allows remote attackers to crash applications or potentially leak sensitive memory contents when processing maliciously crafted WAV files. The vulnerability affects all GStreamer versions prior to 1.24.10 and can be triggered without authentication through network-accessible media processing applications. While no active exploitation has been observed in the wild (not in KEV), the vulnerability has a high CVSS score of 9.1 and detailed technical analysis is publicly available.
Technical Context
GStreamer is a widely-used open-source multimedia framework for constructing media processing pipelines, identified by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability occurs in the gst_wavparse_cue_chunk function within gstwavparse.c, where a size calculation error allows reading beyond allocated buffer boundaries when parsing CUE chunks in WAV files. This is a classic CWE-125 out-of-bounds read vulnerability caused by improper validation of chunk sizes against available buffer data, specifically when the comparison 'if (size < 4 + ncues * 24)' fails due to upstream data size miscalculation during chunk clipping operations.
Affected Products
GStreamer versions prior to 1.24.10 are vulnerable to this out-of-bounds read issue, as confirmed by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability affects the core GStreamer library used by numerous multimedia applications across Linux distributions and other platforms. Debian has issued security updates as noted in their advisory at https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html. Full details are available in the official GStreamer security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0027.html.
Remediation
Upgrade GStreamer to version 1.24.10 or later, which contains the official patch available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch. System administrators should prioritize updating media processing servers and applications that handle untrusted WAV files from external sources. As a temporary mitigation until patching is complete, consider implementing input validation to reject or sanitize WAV files before processing, or isolating media processing services in sandboxed environments to limit the impact of potential crashes or memory disclosure.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today