CVE-2024-47541

What it actually does

Out-of-bounds write in gst_ssa_parse_remove_override_codes when a closing curly bracket precedes an opening one, causing memmove to receive progressively larger sizes (strlen(end+1)) that exceed the allocated buffer during SSA override code removal.

Why it matters to the business

Applications using GStreamer for media with subtitles can crash when processing malformed SSA content, interrupting playback, transcoding, or streaming pipelines and requiring restarts or fallback handling.

How an attack unfolds

An attacker supplies a crafted SSA subtitle string containing a closing bracket before any opening bracket; the parser enters a loop that repeatedly calls memmove with increasing lengths, writing past the end of the allocated buffer and triggering a crash or potential memory corruption.

How to fix it

Upgrade GStreamer to version 1.24.10 or apply commit 5be4b6f03689ab438822f6cfcd13f1f300afe203 in the gstssaparse.c file; rebuild and redeploy any dependent applications or containers.

How to confirm the fix worked

Confirm the installed GStreamer version reports 1.24.10 or later; test the fixed build against a sample input containing a premature closing curly bracket and verify no crash or memory error occurs.

Typical attack path

1. Identify a GStreamer-based application that parses SSA subtitles
2. Craft an input containing a closing curly bracket before any opening bracket in the override section
3. Deliver the malformed subtitle via file, stream, or metadata to the target application
4. Trigger repeated parsing of the input to execute the vulnerable loop and oversized memmove
5. Observe denial of service from the resulting out-of-bounds write

How to detect it

Review application and system logs for segmentation faults or aborts occurring inside gstssaparse during subtitle parsing; correlate with inbound media files containing SSA tracks and inspect process core dumps for buffer-overrun patterns.

What your security team should do

• Immediately update all GStreamer installations to 1.24.10 or the referenced commit
• Scan build pipelines and dependency manifests for older GStreamer versions and enforce the fixed release
• Add SSA subtitle fuzzing to media ingestion test suites
• Monitor crash reports for media-processing services handling subtitle tracks