CVE-2024-0444

What it actually does

Stack-based buffer overflow in AV1 tile list parsing due to missing length validation before copying user data into a fixed-size stack buffer, enabling arbitrary code execution in the GStreamer process context.

Why it matters to the business

Systems that decode or play AV1 video streams risk remote compromise, allowing attackers to run malicious code and potentially disrupt media workflows or steal data.

How an attack unfolds

An attacker creates a specially crafted AV1 video file containing oversized tile list data. When a vulnerable GStreamer installation parses the file during playback or processing, the overflow overwrites the stack and redirects execution to attacker-supplied code.

How to fix it

Upgrade GStreamer to commit f368d63ecd89e01fd2cf0b1c4def5fc782b2c390 or later. Rebuild and redeploy any applications that statically link the affected library.

How to confirm the fix worked

Confirm the installed GStreamer source matches or exceeds commit f368d63ecd89e01fd2cf0b1c4def5fc782b2c390; test with known-good and malformed AV1 samples to verify parsing no longer overflows.

Typical attack path

1. Craft malicious AV1 video with oversized tile list metadata
2. Deliver file via web download, email, or media stream
3. Victim application invokes GStreamer to parse the AV1 content
4. Overflow occurs during tile list copy into stack buffer
5. Attacker payload executes with privileges of the GStreamer process

How to detect it

Review application logs and process crash dumps for AV1 parsing errors or stack corruption around media handling routines; correlate with file access timestamps of AV1 content from untrusted sources.

What your security team should do

• Immediately update all GStreamer installations to the fixed commit
• Inventory and replace any embedded or statically linked copies of the library
• Restrict untrusted AV1 media processing until patches are applied
• Monitor for new GStreamer releases and schedule automated dependency updates