CVE-2024-47599

What it actually does

Null pointer dereference in gst_jpeg_dec_negotiate when gst_video_decoder_set_output_state returns NULL, causing immediate SEGV on subsequent outstate pointer access.

Why it matters to the business

Media-handling applications using GStreamer can crash when processing certain JPEG streams, interrupting video pipelines and related services with no data theft or remote code execution observed.

How an attack unfolds

An attacker supplies a JPEG stream that forces gst_video_decoder_set_output_state to return NULL inside gst_jpeg_dec_negotiate; the missing NULL check then dereferences the invalid pointer and terminates the process.

How to fix it

Upgrade gstreamer/gstreamer to the commit 5be4b6f03689ab438822f6cfcd13f1f300afe203 or later 1.24.10-equivalent release; rebuild any dependent packages and restart affected services.

How to confirm the fix worked

Confirm the updated gstjpegdec.c contains an explicit NULL check after gst_video_decoder_set_output_state; re-test the pipeline with the previously crashing JPEG input and verify absence of SEGV.

Typical attack path

1. Identify a GStreamer-based media pipeline that uses the jpegdec element
2. Craft or obtain a JPEG input that triggers failure inside gst_video_decoder_set_output_state
3. Feed the input into the pipeline to invoke gst_jpeg_dec_negotiate
4. Trigger segmentation fault and denial of service

How to detect it

Search process crash logs and core dumps for segmentation faults originating from gstjpegdec.c or the jpegdec element; correlate with inbound JPEG streams processed around the crash timestamp.

What your security team should do

• Apply the fixed commit or 1.24.10 release across all GStreamer installations
• Prioritize update for any externally reachable media-processing services
• Add crash monitoring for processes linked against libgstjpegdec
• Review downstream dependents for inherited exposure