CVE-2024-47835
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Description
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function calls strchr() to find the character ']' in the string line. The pointer returned by this call is then passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed in 1.24.10.
Analysis
A null pointer dereference vulnerability in GStreamer's subtitle parsing functionality allows remote attackers to crash applications processing malformed LRC (lyric) files. The vulnerability affects GStreamer versions prior to 1.24.10 and can be triggered when parsing subtitle files missing expected ']' characters, resulting in denial of service. With a relatively low EPSS score of 0.08% and no known active exploitation, this represents a moderate risk primarily to media applications using GStreamer for subtitle processing.
Technical Context
GStreamer is a widely-used open-source multimedia framework that constructs graphs of media-handling components for applications. The vulnerability (CWE-476: NULL Pointer Dereference) occurs in the parse_lrc function within gstsubparse.c, which handles LRC subtitle file parsing. When processing a line that lacks the expected ']' character, the strchr() function returns NULL, but the code attempts to dereference this NULL pointer by passing it to g_strdup(start + 1), causing the application to crash. Based on the CPE identifier cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*, all GStreamer versions prior to 1.24.10 are affected.
Affected Products
GStreamer multimedia framework versions prior to 1.24.10 are vulnerable to this null pointer dereference issue, as indicated by the CPE identifier cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability specifically affects the subtitle parsing functionality within the gstsubparse component. Organizations should consult the official GStreamer security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0029.html for complete details. Debian LTS users should also review the security announcement at https://lists.debian.org/debian-lts-announce/2024/12/msg00021.html for distribution-specific guidance.
Remediation
Upgrade GStreamer to version 1.24.10 or later, which contains the fix for this vulnerability. The patch is available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8039.patch and can be applied to earlier versions if immediate upgrading is not feasible. As a temporary workaround, avoid processing untrusted or external subtitle files, particularly LRC format files, until patching is complete. Organizations should review the vendor security advisory at https://gstreamer.freedesktop.org/security/sa-2024-0029.html and the detailed analysis at https://securitylab.github.com/advisories/GHSL-2024-263_Gstreamer/ for additional context.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today