CVE-2024-47544: gstreamer NULL Pointer Dereference
CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2024-47544DEBIAN-CVE-2024-47544CGA-88jj-r8fv-79v4CGA-gfgx-3m7q-ppf3CGA-36qc-2m69-72jgCGA-4cc8-wqfx-f769CGA-4vx4-p295-gjp4CGA-537x-29c3-vv7hCGA-5f9r-rpxc-34w4CGA-75vv-v8wf-q363CGA-842q-35jg-xp4vCGA-8cx9-h3mh-x899CGA-c24m-qrfh-9vgrCGA-c7pw-cwrr-j7prCGA-cr3j-3hxf-mjxgCGA-f7v5-8f58-7fmfCGA-f9vv-g63x-c27xCGA-g2c3-g43w-v9gfCGA-hjv3-846m-7xjqCGA-hx3j-872g-w899CGA-j32v-68rr-rch4CGA-mf9w-p549-6wmwCGA-mp6x-pm29-vp6cCGA-p4qp-5j6x-h3p7CGA-p6w8-88fh-wwvpCGA-pffv-2w42-q46fCGA-q7fc-83xw-x6c6CGA-qgfx-7p52-9xw6CGA-r6cq-ccqm-gfw2CGA-rf29-3pg8-7qq2CGA-rqh8-cxp5-589gCGA-vj9f-rw9m-2vhgCGA-vjqc-3wc6-35vjCGA-vjrg-4w6r-w9r4CGA-w54j-g9qh-vcqpCGA-xx58-vxqw-3hg3
Published 11-12-2024Last modified 03-11-2025
Vulnerability summary
CVE-2024-47544 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in gstreamer. EPSS estimates a 1.08% chance of exploitation in the next 30 days, higher than 64.6% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
1.08%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 11 · Related 12Timeline
- 11-12-2024PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
GStreamer is a library for constructing graphs of media-handling components. The function qtdemux_parse_sbgp in qtdemux.c is affected by a null dereference vulnerability. This vulnerability is fixed in 1.24.10.
CVSS metrics
8 scores · 6 sources · 2 versionsMedium 6.8Preferred score · CVE.org (CNA)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated6.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated6.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST6.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.08%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
0.00 pp
From 1.08% on 19-09-2026
19-09-202619-10-2026
EPSS score1.08%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard17 products
- openjdk-11-openj9-default-policy< 0.53.0-r0
- openjdk-17-openj9-default-policy< 0.53.0-r0
- openjdk-21-openj9-default-policy< 0.53.0-r0
- openjdk-25-openj9< 0.59.0-r1
- openjdk-25-openj9-dbg< 0.59.0-r1
Ubuntu2 products
- gst-plugins-good0.10All versions (No fix recorded)
- gst-plugins-good1.0All versions (No fix recorded) | < 1.16.3-0ubuntu1.3 | < 1.20.3-0ubuntu1.3 | < 1.24.2-1ubuntu1.1
Debian1 product
- gst-plugins-good1.0< 1.22.0-5+deb12u2 | < 1.24.10-1
Gstreamer1 product
- gstreamer< 1.24.10
Wolfi1 product
- openjdk-7-jre-libAll versions (No fix recorded)
5 vendors · 22 products
References
10 links- securitylab.github.com/advisories/GHSL-2024-238_Gstreamer/X Refsource CONFIRMREPORTAdvisoryThird Party Advisory
