CVE-2016-9447: gstreamer Out-of-bounds Read
Vulnerability summary
CVE-2016-9447 is a high (CVSS 7.8) Out-of-bounds Read vulnerability in gstreamer. EPSS estimates a 2.84% chance of exploitation in the next 30 days, higher than 86.6% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 2Timeline
- 23-01-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) and possibly execute arbitrary code via a crafted NSF music file.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.84%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.84% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- gst-plugins-bad0.10< 0.10.23-7.4+deb8u1
Gstreamer1 product
- gstreamer0.10.0 | 0.10.1 | 0.10.2 | 0.10.3 | 0.10.4 | 0.10.5 | 0.10.6 | 0.10.7 | 0.10.8 | 0.10.9 | 0.10.10 | 0.10.11 | 0.10.12 | 0.10.13 | 0.10.14 | 0.10.15 | 0.10.16 | 0.10.17 | 0.10.18 | 0.10.19 | 0.10.20 | 0.10.21 | 0.10.22 | 0.10.23 | 0.10.24 | 0.10.25 | 0.10.26 | 0.10.27 | 0.10.28 | 0.10.29 | 0.10.30 | 0.10.31 | 0.10.32 | 0.10.33 | 0.10.34 | 0.10.35 | 0.10.36
Ubuntu1 product
- gst-plugins-bad0.10< 0.10.23-7.2ubuntu1.2
3 vendors · 3 products
References
9 links- scarybeastsecurity.blogspot.de/2016/11/0day-exploit-compromising-linux-desktop.htmlX Refsource MISCREPORT