Null Pointer Dereference in id3v2_read_synch_uint Function

CVE-2024-47542

What is CVE-2024-47542?

A vulnerability exists in the GStreamer library due to a null pointer dereference encountered in the id3v2_read_synch_uint function within id3v2.c. When the function is invoked with a null reference for work->hdr.frame_data, it accesses the pointer guint8 *data without performing necessary validation checks. This oversight can lead to a segmentation fault, resulting in a Denial of Service (DoS) condition. Affected users of GStreamer should update to version 1.24.10 or higher to mitigate this vulnerability. For further details, refer to the official advisory and patches provided by the GStreamer development team.

References