CVE-2024-47546

What it actually does

Integer underflow in extract_cc_from_data within qtdemux.c allows atom_length - 8 to wrap when processing a FOURCC_c708 box smaller than 8 bytes, resulting in an oversized cclen value passed to g_memdup2 and an out-of-bounds read.

Why it matters to the business

Applications that use GStreamer to parse or play media files can crash or become unavailable when handling specially crafted files, disrupting media pipelines and content delivery workflows until patched versions are deployed.

How an attack unfolds

An attacker supplies a malicious QuickTime or MP4 container containing a c708 atom with an atom_length value less than 8. When GStreamer parses the file the underflow occurs, g_memdup2 reads far beyond intended bounds, and the process either crashes or leaks adjacent memory.

How to fix it

Upgrade gstreamer to version 1.24.10 or apply commit 5be4b6f03689ab438822f6cfcd13f1f300afe203 in the qtdemux module. Rebuild and redeploy any dependent applications after the update.

How to confirm the fix worked

Confirm the installed GStreamer version reports 1.24.10 or later, or verify the presence of the referenced commit in the qtdemux.c source. Re-test media ingestion with previously crashing sample files to ensure no crash occurs.

Typical attack path

1. Attacker crafts a QT/MP4 file with a c708 atom sized below 8 bytes
2. Victim application opens or processes the file using an unpatched GStreamer pipeline
3. qtdemux calls extract_cc_from_data and performs the underflowing subtraction
4. g_memdup2 receives a large cclen and performs an out-of-bounds read
5. Process terminates with a segmentation fault or memory corruption

How to detect it

Monitor application and system logs for unexpected crashes or segmentation faults in processes linked against GStreamer while ingesting media files; correlate timestamps with file-processing activity.

What your security team should do

• Immediately update all GStreamer installations to 1.24.10 or the equivalent patched commit
• Inventory and prioritize update of any media-processing services or containers that depend on GStreamer
• Add GStreamer version checks to build and deployment pipelines to prevent re-introduction of vulnerable releases