Out-of-Bounds Read in GStreamer Library Affecting Media Applications

CVE-2024-47596

What is CVE-2024-47596?

A vulnerability has been identified in the GStreamer library, specifically within the qtdemux_parse_svq3_stsd_data function of qtdemux.c. This issue arises when the seqh_size is read from an input file without appropriate validation. If the read value exceeds the buffer's remaining size, it triggers an out-of-bounds read in the subsequent gst_buffer_fill operation, which utilizes memcpy internally. Such a condition may lead to significant security risks including unauthorized reading of process memory, potentially revealing sensitive data, or may cause segmentation faults by attempting to access invalid memory areas. The vulnerability has been addressed in version 1.24.10 of GStreamer.

References