CVE-2024-47777
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
3Description
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_wavparse_smpl_chunk function within gstwavparse.c. This function attempts to read 4 bytes from the data + 12 offset without checking if the size of the data buffer is sufficient. If the buffer is too small, the function reads beyond its bounds. This vulnerability may result in reading 4 bytes out of the boundaries of the data buffer. This vulnerability is fixed in 1.24.10.
Analysis
An out-of-bounds read vulnerability exists in GStreamer's WAV file parser that allows remote attackers to read 4 bytes of memory beyond buffer boundaries when processing specially crafted WAV files. The vulnerability affects all GStreamer versions prior to 1.24.10 and can lead to information disclosure or application crashes when parsing malicious media files. While no active exploitation has been reported and the vulnerability is not listed in CISA's KEV catalog, the network-based attack vector and lack of authentication requirements make this a significant security concern for applications using GStreamer for media processing.
Technical Context
GStreamer is a widely-used open-source multimedia framework that creates pipelines for handling various media formats across platforms. The vulnerability specifically resides in the gst_wavparse_smpl_chunk function within gstwavparse.c, which processes sample chunk data in WAV audio files. According to the CPE identifier (cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*), all versions of GStreamer prior to 1.24.10 are affected. The root cause is a classic CWE-125 out-of-bounds read where the function attempts to read 4 bytes from a data+12 offset without first validating that the buffer contains sufficient data, potentially reading past allocated memory boundaries when processing malformed or malicious WAV files.
Affected Products
GStreamer multimedia framework versions prior to 1.24.10 are vulnerable to this out-of-bounds read issue, as confirmed by the CPE identifier cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability affects any application or system using these versions of GStreamer for WAV file parsing, including media players, streaming services, and content processing pipelines. The vendor has published an official security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0027.html detailing the impact, and Debian has issued security updates as noted in their announcement at https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html.
Remediation
Upgrade GStreamer to version 1.24.10 or later immediately, as this version contains the official patch that adds proper bounds checking to the gst_wavparse_smpl_chunk function. The patch is available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch and should be applied through your distribution's package manager or by building from source. For systems that cannot be immediately updated, implement input validation to reject or sanitize WAV files before processing, restrict GStreamer-based applications from processing untrusted media files, and consider running media processing services in isolated containers or sandboxes to limit the impact of potential exploitation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today