CVE-2024-47598

What it actually does

Out-of-bounds read of up to 4 bytes in qtdemux_merge_sample_table when parsing the stts sample table in MP4/QT containers, caused by missing bounds check on stts->data before accessing stts_duration.

Why it matters to the business

Applications using GStreamer to process untrusted media files may crash or behave unexpectedly, leading to denial of service in media pipelines, playback services, or content ingestion systems; high prevalence in multimedia software increases exposure across desktop, server, and embedded environments.

How an attack unfolds

An attacker crafts a malicious MP4 file containing a malformed stts atom with an undersized buffer, then causes a target application to open and parse the file with GStreamer; qtdemux_merge_sample_table reads 4 bytes past the allocated stts buffer, potentially triggering crashes or limited information disclosure depending on memory layout.

How to fix it

Upgrade GStreamer to version 1.24.10 or later; apply commit 5be4b6f03689ab438822f6cfcd13f1f300afe203 in GIT builds; rebuild and redeploy any dependent applications or containers after updating the library.

How to confirm the fix worked

Confirm the installed GStreamer version is 1.24.10 or newer; test parsing of known-malformed test files that previously triggered the OOB read; verify the qtdemux.c source contains the bounds check added in the referenced commit.

Typical attack path

1. Attacker creates specially crafted MP4/QT file with invalid stts sample table size
2. Victim or automated system opens or streams the malicious file using a GStreamer-based application
3. qtdemux parses the stts atom and calls qtdemux_merge_sample_table without proper bounds validation
4. Four bytes are read beyond the stts->data allocation, causing memory corruption effects

How to detect it

Review application logs and crash reports for segmentation faults or memory errors during MP4/QT demuxing; search process memory dumps or core files for evidence of stts table processing anomalies; no public exploitation artifacts are known at this time.

What your security team should do

• Immediately update all GStreamer installations to 1.24.10 or the patched GIT commit
• Scan media ingestion and playback services for use of vulnerable GStreamer versions
• Add media file sanitization or sandboxing for untrusted content until patches are applied
• Monitor EPSS and exploit maturity indicators for any increase in observed activity