GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability
CVE-2023-40475

8.8HIGH

Key Information:

Vendor

Gstreamer

Status
Gstreamer
Vendor
CVE Published:
3 May 2024

What is CVE-2023-40475?

An integer overflow vulnerability exists in the GStreamer multimedia framework specifically related to the parsing of MXF video files. This flaw arises from insufficient validation of user-supplied data, leading to potential overflows before buffer allocation. Attackers can leverage this weakness to execute arbitrary code within the context of the affected process, posing significant risks to systems that utilize GStreamer for media handling. Proper security measures and updates are crucial to mitigate such vulnerabilities.

Affected Version(s)

GStreamer 1.22.4 and 8dddb9ad2009705dfc3e50d59d7c56fc7314cfc3

References

https://www.zerodayinitiative.com/advisories/ZDI-23-1457/
x_research-advisory
https://gstreamer.freedesktop.org/security/sa-2023-0007.html
vendor-advisory

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.