CVE-2024-47596

What it actually does

Out-of-bounds read in qtdemux_parse_svq3_stsd_data when parsing FOURCC_SMI_ data: seqh_size is taken from attacker-controlled input without bounds checking against the remaining buffer, allowing gst_buffer_fill to perform an unbounded memcpy that can read up to 4 GB of process memory or trigger a segmentation fault.

Why it matters to the business

Applications that parse untrusted media files using GStreamer can leak sensitive process memory or crash, leading to potential information disclosure, denial of service, or downstream instability in media pipelines and players.

How an attack unfolds

An attacker crafts a QT/MP4 container with a malformed SVQ3 sample description atom containing an oversized seqh_size value. When qtdemux processes the file, the missing validation causes an oversized read via gst_buffer_fill, disclosing adjacent memory or crashing the process.

How to fix it

Upgrade GStreamer to version 1.24.10 or later. The fix is present in commit 5be4b6f03689ab438822f6cfcd13f1f300afe203. Rebuild and redeploy any dependent packages that statically link or vendor an older GStreamer.

How to confirm the fix worked

Confirm the installed GStreamer version is 1.24.10 or newer; recompile applications against the patched library; test with a crafted SVQ3-containing file to verify absence of OOB access or crash.

Typical attack path

1. Attacker supplies a malicious media file to any GStreamer-based parser or player
2. qtdemux encounters a FOURCC_SMI_ atom and reads seqh_size directly from the file
3. seqh_size exceeds remaining buffer length with no validation
4. gst_buffer_fill performs memcpy of attacker-controlled size
5. Resulting OOB read discloses process memory or causes SEGV

How to detect it

Look for unexpected segmentation faults or memory-access violations in processes using libgstreamer while parsing QT/MP4 files; review application or system logs for crashes originating from qtdemux.c or gst_buffer_fill.

What your security team should do

• Immediately update GStreamer to 1.24.10 across all build pipelines and runtime environments
• Inventory and rebuild all downstream packages that depend on GStreamer
• Add media-file fuzzing to CI pipelines targeting qtdemux
• Monitor for process crashes or memory-access anomalies when handling untrusted media