Gstreamer
CVE-2024-47778
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS score of 7.5 indicates high severity due to network exploitability with no authentication required (AV:N/AC:L/PR:N/UI:N), the real-world risk appears significantly lower. The EPSS score of 0.08% places it in only the 24th percentile for exploitation likelihood, suggesting minimal attacker interest. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept exists. The primary impact is availability (A:H) through denial of service rather than data theft, as the CVSS vector shows no confidentiality or integrity impact. This appears to be a high-CVSS-but-low-real-risk issue that should be patched during regular maintenance cycles rather than emergency response. |
| Exploit ScenarioDerived | An attacker could host a malicious WAV file on a web server or send it via email attachment to targets running vulnerable GStreamer versions. When the victim's media application attempts to parse the crafted WAV file, the vulnerability triggers an out-of-bounds read that could expose up to 4GB of process memory or crash the application. Given the network attack vector and low complexity, exploitation requires only that the victim process the malicious file, though no public proof-of-concept currently exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
An out-of-bounds read vulnerability exists in GStreamer's WAV parser that allows remote attackers to read up to 4GB of process memory or cause a denial of service through crashes. The vulnerability affects GStreamer versions prior to 1.24.10 and requires no authentication to exploit over the network. With an EPSS score of only 0.08%, real-world exploitation appears limited, and no known proof-of-concept or active exploitation has been reported.
RemediationAI
Upgrade GStreamer to version 1.24.10 or later, which contains the fix for this vulnerability. The patch is available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch and should be applied through your distribution's package manager or by building from source. For systems that cannot be immediately updated, consider implementing input validation for WAV files before processing them through GStreamer, or isolating GStreamer processes in sandboxed environments to limit the impact of potential memory disclosure. Consult the vendor security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0027.html for additional guidance.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a widely-used open-source multimedia framework for constructing media processing pipelines, identified by CPE cpe:2.3:a:gstreamer:gstreamer. The vulnerability resides in the gst_wavparse_adtl_chunk function within gstwavparse.c, where insufficient validation of a size parameter leads to a classic out-of-bounds read condition (CWE-125). When processing specially crafted WAV files, the parser fails to properly bounds-check the size value before entering a while loop, potentially reading memory beyond the allocated data buffer boundaries.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in gst_wavparse_adtl_chunk within gstwavparse.c. This vulnerability arises due to insufficient validation of the size parameter, which can exceed the bounds of the data buffer. As a result, an OOB read occurs in the following while loop. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10.
Executive ViewAI
Organizations using GStreamer face notable risk from CVE-2024-47778, a out-of-bounds read vulnerability rated CVSS 7.5. Exploitation could compromise the security of affected deployments. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)GitHub Advisory
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
Exploit-DB