Integer Underflow Vulnerability in GStreamer Media Library

CVE-2024-47545

What is CVE-2024-47545?

An integer underflow vulnerability has been identified in the 'qtdemux_parse_trak' function within qtdemux.c of the GStreamer media handling library. During the parsing of the 'strf' sub-element, the size variable can become negatively valued when it is less than 40 due to the subtraction operation. This scenario causes the subsequent call to 'gst_buffer_fill' to execute 'memcpy' with an excessively large size, potentially leading to an out-of-bounds read (OOB-read) condition. This flaw can be exploited by adversaries to perform unauthorized memory accesses, exposing applications to various security risks. The vulnerability has been addressed in version 1.24.10.

References