CVE-2023-37328

What it actually does

Heap-based buffer overflow in PGS subtitle file parsing due to missing validation of user-supplied data length before copying into a heap buffer, enabling arbitrary code execution in the context of the GStreamer process.

Why it matters to the business

Remote attackers can achieve code execution on systems that process untrusted media containing PGS subtitles, risking full system compromise in media playback, transcoding, or streaming pipelines; prevalence in GStreamer-based applications increases exposure across desktop and embedded environments.

How an attack unfolds

An attacker crafts a malicious PGS subtitle file with oversized data that bypasses length checks during parsing; the file is delivered to a victim application using GStreamer, which triggers the overflow and executes attacker-supplied code when the subtitle data is processed.

How to fix it

Upgrade GStreamer to the fixed commit e2107f0a0fff902ac7f184bf96150cdc49ccf156 in all affected GIT builds; rebuild and redeploy dependent applications; avoid processing untrusted PGS subtitle content until patched.

How to confirm the fix worked

Confirm the installed GStreamer commit hash matches e2107f0a0fff902ac7f184bf96150cdc49ccf156; test media playback with known-malformed PGS samples in a sandbox to verify absence of crashes or unexpected behavior.

Typical attack path

1. Craft PGS subtitle file with excessive data length to trigger overflow
2. Embed malicious file in container media delivered via download, email, or web
3. Victim application opens or processes the media using GStreamer
4. GStreamer PGS parser copies data without bounds checking
5. Overflow allows control of execution flow and code execution

How to detect it

Review application logs and crash dumps for GStreamer processes handling subtitle parsing; search for abnormal heap operations or segmentation faults during PGS file processing in media workflows.

• GStreamer process crashes during PGS subtitle parsing
• Heap overflow indicators in gstsubparse or PGS-related functions

What your security team should do

• Immediately update all GStreamer installations to the fixed commit e2107f0a0fff902ac7f184bf96150cdc49ccf156
• Inventory and patch downstream applications and containers using GStreamer
• Implement input sanitization or sandboxing for media file processing until upgrades complete
• Monitor for new exploit maturity indicators given stable but non-zero EPSS