CVE-2016-9811

What it actually does

Out-of-bounds read in the windows_icon_typefind function of gst-plugins-base when G_SLICE is set to always-malloc, triggered by a crafted ICO file and resulting in denial of service.

Why it matters to the business

Processing of untrusted image files can cause application crashes, leading to service disruption in environments that rely on GStreamer for media handling; the issue affects packages used in monitoring exporters with fixes available since early 2017.

How an attack unfolds

An attacker supplies a specially crafted ICO file to an application using an affected GStreamer version; when the windows_icon_typefind function processes the file under the always-malloc memory allocator setting, an out-of-bounds read occurs and crashes the process.

How to fix it

Upgrade affected packages to the fixed versions: prometheus-elasticsearch-exporter (Chainguard) 1.7.0-r2, prometheus-elasticsearch-exporter (Wolfi) 1.7.0-r2, prometheus-elasticsearch-exporter-bitnami-compat (Chainguard) 1.7.0-r2, and prometheus-elasticsearch-exporter-bitnami-compat (Wolfi) 1.7.0-r2. Rebuild and redeploy any containers or images that embed the vulnerable GStreamer components.

How to confirm the fix worked

Confirm the running GStreamer version is at least 1.10.2, verify the G_SLICE environment variable is not forced to always-malloc in production, and test file ingestion with known-good and known-bad ICO samples to ensure no crash occurs.

Typical attack path

1. Identify or compromise an entry point that feeds image files into GStreamer-based processing
2. Craft an ICO file that triggers the vulnerable typefind code path
3. Deliver the file so it is parsed with G_SLICE set to always-malloc
4. Observe application crash or denial of service

How to detect it

Review application logs for segmentation faults or crashes during ICO file handling; inspect process startup environment variables for G_SLICE=always-malloc; search historical file-processing logs for entries referencing .ico files immediately preceding crashes.

What your security team should do

• Immediately update all listed prometheus-elasticsearch-exporter packages to the 1.7.0-r2 releases
• Audit any custom builds or dependencies that pull in gst-plugins-base older than 1.10.2
• Disable or avoid the always-malloc G_SLICE setting for media-processing workloads
• Add file-type validation or sandboxing around ICO processing to reduce attack surface