Denial of Service Vulnerability in GStreamer Matroska Plugin

CVE-2022-1925

What is CVE-2022-1925?

This vulnerability resides in the GStreamer Matroska plugin due to an integer overflow in the matroskaparse element during mkv demuxing. Specifically, a heap overflow can occur within the gst_matroska_decompress_data function when using HEADERSTRIP decompression. Although the matroskademux element enforces certain restrictions on chunk sizes to prevent overflow exploitation, the matroskaparse element lacks suitable size checks, potentially allowing attackers to induce a Denial of Service in affected systems.

References