Out-of-Bounds Read Vulnerability in GStreamer Library by Freedesktop

CVE-2024-47597

What is CVE-2024-47597?

A vulnerability exists in the GStreamer library, specifically in the function qtdemux_parse_samples located in qtdemux.c. This vulnerability manifests as an out-of-bounds read condition when the function improperly accesses data beyond the allocated boundaries of the stream->stco buffer. The flaw allows the potential reading of up to 8 bytes beyond the intended data range, particularly when parsing malicious media files such as GHSL-2024-245_crash1.mp4. The issue has been addressed in GStreamer version 1.24.10, with patches provided to mitigate the risk.

References