CVE-2021-3522

What it actually does

Out-of-bounds read during ID3v2 tag parsing in GStreamer media handling code, resulting in process crash due to invalid memory access.

Why it matters to the business

Media playback or processing applications can unexpectedly terminate when users open crafted audio or video files, disrupting workflows and requiring restarts or workarounds until patched.

How an attack unfolds

An attacker creates a media file containing a specially malformed ID3v2 tag, delivers it to a target (via download, email, or shared storage), and relies on the victim opening the file in any GStreamer-based application, which triggers the out-of-bounds read and denial of service.

How to fix it

Upgrade GStreamer to version 1.18.4 or later; for GIT builds apply commit b5b2e3b9208f1f93bc5b0244d29dfed157d78293 or newer equivalent release.

How to confirm the fix worked

Confirm installed GStreamer version is 1.18.4 or newer; test playback of known-good ID3-tagged files and verify absence of crashes on boundary-tag samples; review build logs for the referenced commit hash.

Typical attack path

1. Craft media file embedding malicious ID3v2 tag data
2. Distribute the file through user-accessible channels
3. Victim opens the file using a GStreamer-dependent media player or library
4. Parser performs out-of-bounds read leading to application crash

How to detect it

Review application and system logs for GStreamer process crashes or segmentation faults occurring during media file parsing; correlate timestamps with user-opened media files containing ID3 tags.

What your security team should do

• Immediately update all GStreamer installations to the fixed version
• Inventory applications and libraries that depend on GStreamer for media handling
• Block or sandbox untrusted media file sources until patches are applied
• Monitor vendor advisories for downstream package updates