CVE-2024-47543: gstreamer Out-of-bounds Read

Vulnerability summary

CVE-2024-47543 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in gstreamer. EPSS estimates a 0.92% chance of exploitation in the next 30 days, higher than 59.7% of scored vulnerabilities.

Timeline

1. 11-12-2024
   PublishedVulnerability first disclosed.
2. 03-11-2025
   Last modifiedVulnerability information updated.

Description

GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in qtdemux_parse_container function within qtdemux.c. In the parent function qtdemux_parse_node, the value of length is not well checked. So, if length is big enough, it causes the pointer end to point beyond the boundaries of buffer. Subsequently, in the qtdemux_parse_container function, the while loop can trigger an OOB-read, accessing memory beyond the bounds of buf. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.