Gstreamer CVE-2024-47777

The CVSS 3.1 score of 9.1 reflects high severity due to the network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N), resulting in high confidentiality and availability impacts. However, real-world exploitation risk appears moderate as there is no evidence of active exploitation, no inclusion in CISA's KEV catalog, and no publicly available proof-of-concept code referenced. The vulnerability requires an attacker to deliver a malicious WAV file to a target application, limiting attack scenarios compared to remote code execution flaws. The high CVSS score primarily stems from the theoretical network exposure and lack of authentication requirements, but practical exploitation would still require specific conditions where untrusted WAV files are processed by vulnerable GStreamer installations.

An attacker crafts a malicious WAV audio file with a specially formatted sample chunk that triggers the out-of-bounds read when processed by a vulnerable GStreamer application. When a media streaming service or content management system processes this file, the vulnerability could leak 4 bytes of adjacent memory which might contain sensitive data, or cause the application to crash leading to denial of service. Given the network attack vector and no authentication requirements, this could be exploited through file upload features, media streaming endpoints, or any service that accepts and processes user-supplied WAV files.