CVE-2019-9928

What it actually does

Heap-based buffer overflow in the RTSP connection parser via a crafted server response, enabling potential remote code execution.

Why it matters to the business

Media and streaming applications using GStreamer face risk of remote compromise, leading to system takeover, data exposure, or service disruption in environments handling RTSP streams.

How an attack unfolds

An attacker controls or impersonates an RTSP server and responds to a client connection with a specially crafted response that overflows the heap buffer in the parser, achieving code execution on the client system.

How to fix it

Upgrade GStreamer to 1.16.0 or later by applying commit 2c3480796a6673c638f5b12c7bdf5c0f191120fd; for cluster-autoscaler-fips-1.25 update to version 1.25.3-r5.

How to confirm the fix worked

Confirm installed GStreamer version meets or exceeds 1.16.0, review build logs for the referenced commit, and validate that RTSP parsing no longer crashes on malformed responses.

Typical attack path

1. Position a malicious or compromised RTSP server reachable by the target
2. Trigger a GStreamer-based client to initiate an RTSP connection
3. Send a crafted RTSP response containing oversized or malformed data
4. Exploit the resulting heap overflow to execute attacker-controlled code

How to detect it

Inspect application and system logs for GStreamer process crashes or segmentation faults during RTSP sessions; correlate with inbound RTSP traffic from untrusted servers.

What your security team should do

• Prioritize upgrade of all GStreamer instances to the fixed versions listed
• Inventory applications and containers depending on GStreamer for RTSP
• Implement network segmentation for media streaming services until patched