Out of Bounds Read in GStreamer Library Affecting Multiple Media Applications

CVE-2024-47598

What is CVE-2024-47598?

An Out of Bounds (OOB) read vulnerability has been detected in the GStreamer library, specifically within the qtdemux_merge_sample_table function in qtdemux.c. This vulnerability arises due to inadequate validation of the stts buffer size before accessing stts_duration. As a result, the program may inadvertently read 4 bytes beyond the allocated memory limits of the stts array, potentially exposing sensitive information or causing undefined behavior in applications leveraging GStreamer. The issue has been addressed in version 1.24.10 of GStreamer.

References