Heap-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-44429

What is CVE-2023-44429?

This vulnerability in GStreamer involves a heap-based buffer overflow in the parsing of AV1 encoded video files. It arises from the inadequate validation of the length of incoming user-supplied data prior to its copying to a fixed-length heap buffer. As a result, an attacker could exploit this flaw to execute arbitrary code within the context of the current process. The potential for attack is dependent on the interaction with the GStreamer library, with various implementation-specific attack vectors possible. This vulnerability is documented under the identifier ZDI-CAN-22226.

References