---
id: CVE-2024-47606
title: GStreamer is a library for constructing graphs of media-handling components
summary: >-
  GStreamer is a library for constructing graphs of media-handling components.
  An integer underflow has been detected in the function
  qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due
  to an underflow of the gint…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-190
  - CWE-191
vendor: gstreamer
product: gstreamer
affected:
  - gstreamer < 1.24.10
  - debian_linux = 11.0
patched:
  - gstreamer 1.24.10
published: '2024-12-12'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:17:24.583'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-47606'
references:
  - url: >-
      https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8032.patch
    label: security-advisories@github.com
  - url: 'https://gstreamer.freedesktop.org/security/sa-2024-0014.html'
    label: security-advisories@github.com
  - url: 'https://securitylab.github.com/advisories/GHSL-2024-166_Gstreamer/'
    label: security-advisories@github.com
  - url: 'https://lists.debian.org/debian-lts-announce/2024/12/msg00016.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20250418-0003/'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-07-24T03:55:28.395401Z'
scores:
  nvd: 9.8
  cna: 8.6
epss: 0.01728
epssPercentile: 0.77645
ingestedAt: '2026-11-05T06:38:03.585Z'
---

## Overview

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.

## Affected

- `gstreamer < 1.24.10`
- `debian_linux = 11.0`

## Remediation

Upgrade past the affected range:

- `gstreamer 1.24.10`