CVE-2024-47539

What it actually does

Out-of-bounds write of up to three bytes in the convert_to_s334_1a function inside isomp4/qtdemux.c caused by a mismatch between allocated storage size and the loop condition i*2 < ccpair_size when ccpair_size is even.

Why it matters to the business

Applications that parse untrusted MP4 files using GStreamer can crash or execute attacker-controlled code, leading to service outages, data breaches, or full system compromise in media pipelines and downstream products.

How an attack unfolds

An attacker crafts an MP4 file whose metadata triggers the vulnerable path in qtdemux during demuxing; when the file is opened by any GStreamer-based player or processor the out-of-bounds write occurs and can be leveraged for code execution.

How to fix it

Upgrade GStreamer to a build containing commit 5be4b6f03689ab438822f6cfcd13f1f300afe203 (equivalent to release 1.24.10 or newer) in all affected packages and rebuild any applications that statically link the library.

How to confirm the fix worked

Confirm the installed GStreamer version reports a commit after 5be4b6f or is at least 1.24.10; re-run unit tests that exercise qtdemux with boundary-case ccpair_size values and verify no out-of-bounds writes occur under ASAN or similar instrumentation.

Typical attack path

1. Craft a malicious MP4 file that sets ccpair_size to an even value causing the size mismatch
2. Deliver the file to a target system or service that uses GStreamer to parse media
3. Trigger parsing of the file through normal media playback, transcoding, or streaming workflows
4. Exploit the resulting out-of-bounds write to corrupt adjacent memory and gain code execution

How to detect it

Search application and system logs for segmentation faults or heap corruption messages originating from qtdemux or gst-launch processes when handling MP4 containers; inspect crash dumps for writes near the convert_to_s334_1a function.

What your security team should do

• Immediately update all GStreamer installations to the fixed commit or 1.24.10 release
• Inventory every application and container image that depends on GStreamer and schedule prioritized rebuilds
• Add GStreamer version checks to CI/CD pipelines and block deployments of vulnerable builds
• Monitor upstream advisories for any follow-on fixes in related demuxers