CVE-2024-47543

What it actually does

Out-of-bounds read in qtdemux_parse_container triggered when qtdemux_parse_node fails to bound the length value, allowing the end pointer to exceed the buffer and the while loop to read up to 4 GB of process memory or fault on invalid addresses.

Why it matters to the business

Media-processing applications and pipelines that rely on GStreamer may crash or disclose large amounts of memory when ingesting untrusted MP4 content, disrupting playback, transcoding, or streaming services.

How an attack unfolds

An attacker supplies a malicious MP4 file containing a container box whose length field is set so that the parser's end pointer lands beyond the allocated buffer; when qtdemux_parse_container iterates over child boxes the OOB read occurs, either leaking memory or causing a segmentation fault.

How to fix it

Upgrade gstreamer/gstreamer to commit 5be4b6f03689ab438822f6cfcd13f1f300afe203 or release 1.24.10; rebuild and redeploy any applications that statically link or bundle the vulnerable library.

How to confirm the fix worked

Confirm the installed GStreamer version reports 1.24.10 or later, or verify the presence of commit 5be4b6f in the source tree; re-test parsing of MP4 files that previously triggered the OOB condition.

Typical attack path

1. Deliver crafted MP4 file to any GStreamer-based media pipeline
2. qtdemux_parse_node reads an oversized length value without bounds checking
3. end pointer is advanced past the buffer limit
4. qtdemux_parse_container while loop performs OOB read

How to detect it

Monitor process logs and crash dumps for segmentation faults originating from qtdemux.c; inspect media-processing service restarts correlated with receipt of MP4 content.

What your security team should do

• Immediately inventory all systems using GStreamer and schedule upgrade to the fixed commit or 1.24.10
• Block or sanitize untrusted MP4 input at ingestion points until patches are applied
• Add GStreamer version checks to build and deployment pipelines