Out-of-Bounds Read Vulnerability in GStreamer Library
CVE-2024-47775
What is CVE-2024-47775?
The GStreamer library, known for its ability to construct media-handling component graphs, has been identified with an out-of-bounds read vulnerability in the parse_ds64 function located within gstwavparse.c. This specific function lacks adequate checks to ensure that the data buffer, referred to as buf, contains sufficient data before executing multiple GST_READ_UINT32_LE operations. The absence of boundary checks opens the possibility for an out-of-bounds read when the buf size is smaller than anticipated. Consequently, this vulnerability may not only lead to a denial of service through potential application crashes but could also result in the unauthorized exfiltration of sensitive information. Users are advised to upgrade to GStreamer version 1.24.10, where this vulnerability has been addressed.