Out-of-Bounds Read and Crash in GStreamer by The gst-plugins-good Vendor
CVE-2016-10199

7.5HIGH

Key Information:

Vendor: Gstreamer Project
Status: Gstreamer
Vendor: CVE Published:; 9 February 2017

🔔 Create Gstreamer Project Vulnerability Alert

What is CVE-2016-10199?

The qtdemux_tag_add_str_full function within gst-plugins-good of GStreamer versions prior to 1.10.3 is susceptible to a vulnerability that allows remote attackers to exploit crafted tag values. This exploitation can lead to an out-of-bounds read condition, ultimately causing a crash in the application, resulting in a denial of service. Users of affected GStreamer versions are advised to update to more secure versions to mitigate this risk.