CVE-2024-47537

What it actually does

Integer overflow during reallocation of stream->samples buffer allows allocation of far fewer elements than requested, followed by an out-of-bounds write when writing samples_count QtDemuxSample structures.

Why it matters to the business

Remote attackers can achieve arbitrary code execution or denial of service in any application that uses GStreamer to process untrusted media files, risking full system compromise in media-handling pipelines or services.

How an attack unfolds

An attacker supplies a crafted media file containing an oversized samples_count value. When GStreamer parses the stream, the integer overflow causes g_try_renew to allocate insufficient memory; subsequent writes of samples_count elements then corrupt adjacent memory, enabling code execution.

How to fix it

Upgrade GStreamer to version 1.24.10 or apply commit 5be4b6f03689ab438822f6cfcd13f1f300afe203. Rebuild and redeploy any dependent applications after the update.

How to confirm the fix worked

Confirm the installed GStreamer version reports 1.24.10 or later; run regression tests with previously crashing sample files and verify that memory bounds checks now prevent the overflow condition.

Typical attack path

1. Craft a media file with a samples_count value large enough to trigger integer overflow on addition
2. Deliver the file to a vulnerable GStreamer-based application or service
3. Trigger parsing of the malicious stream
4. Leverage the resulting out-of-bounds write to achieve code execution or crash the process

How to detect it

Review application logs and crash dumps for GStreamer processes that terminate while parsing media streams; correlate with file-handling activity involving untrusted input.

What your security team should do

• Immediately update all GStreamer installations to the fixed version
• Inventory and replace any statically linked or vendored copies of the library
• Add GStreamer version checks to build and deployment pipelines
• Monitor for new media-processing crash reports as a potential exploitation signal