{"id":"CVE-2024-47606","title":"GStreamer is a library for constructing graphs of media-handling components","summary":"GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-190","CWE-191"],"vendor":"gstreamer","product":"gstreamer","affected":["gstreamer < 1.24.10","debian_linux = 11.0"],"patched":["gstreamer 1.24.10"],"published":"2024-12-12","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:17:24.583","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-47606","references":[{"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8032.patch","label":"security-advisories@github.com"},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0014.html","label":"security-advisories@github.com"},{"url":"https://securitylab.github.com/advisories/GHSL-2024-166_Gstreamer/","label":"security-advisories@github.com"},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00016.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20250418-0003/","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2025-07-24T03:55:28.395401Z"},"scores":{"nvd":9.8,"cna":8.6},"epss":0.01728,"epssPercentile":0.77645,"ingestedAt":"2026-11-05T06:38:03.585Z","slug":"CVE-2024-47606","body":"## Overview\n\nGStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.\n\n## Affected\n\n- `gstreamer < 1.24.10`\n- `debian_linux = 11.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `gstreamer 1.24.10`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}