GStreamer Vulnerability Could Allow Access to Process Memory

CVE-2024-47543

What is CVE-2024-47543?

An out-of-bounds read vulnerability has been identified in the qtdemux_parse_container function within GStreamer's qtdemux.c file. The issue arises due to insufficient validation of the length parameter in the parent function qtdemux_parse_node, which may allow a pointer to exceed the buffer's boundaries. This condition can lead to the while loop in qtdemux_parse_container accessing memory outside valid limits, potentially reading up to 4GB of process memory. This vulnerability may also trigger a segmentation fault (SEGV) when attempting to access invalid memory. A fix for this issue is implemented in version 1.24.10.

References