GHSL-2024-249: GStreamer has a NULL-pointer dereference in Matroska/WebM demuxer

CVE-2024-47601

What is CVE-2024-47601?

The GStreamer library, widely used for constructing media-handling components, has experienced a vulnerability within its parsing function. Specifically, the gst_matroska_demux_parse_blockgroup_or_simpleblock function in matroska-demux.c contains a flaw that does not adequately validate the GstBuffer *sub pointer prior to dereferencing. This oversight can lead to potential null pointer dereferences, posing a risk for stability and security within applications reliant on this library. An update to version 1.24.10 is crucial to mitigate this vulnerability.

References