GHSL-2024-238: GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handling

CVE-2024-47544

What is CVE-2024-47544?

The GStreamer media handling library has a null dereference vulnerability in the function qtdemux_parse_sbgp located in qtdemux.c. This flaw occurs when processing certain media files, enabling potential crashes and instability in applications relying on GStreamer. The vulnerability has been addressed in version 1.24.10, which contains a fix to mitigate the risk associated with this exploitation path. Users are encouraged to update to the latest version to ensure security and stability.

References