CVE-2024-47602

What it actually does

Null pointer dereference in gst_matroska_demux_add_wvpk_header when stream->codec_priv is NULL, causing GST_READ_UINT16_LE to crash the process during Matroska demuxing.

Why it matters to the business

Media-processing applications using GStreamer crash on certain files, producing denial-of-service conditions that interrupt playback, transcoding or streaming workflows.

How an attack unfolds

An attacker creates a specially crafted Matroska container that leaves the codec_priv pointer unset for a WebM/VP8 track; when a victim opens the file with any GStreamer-based player or pipeline, the demuxer dereferences the null pointer and terminates the process.

How to fix it

Upgrade gstreamer to version 1.24.10 or later; the fix is present in commit 5be4b6f03689ab438822f6cfcd13f1f300afe203. Rebuild and redeploy any dependent applications after the update.

How to confirm the fix worked

Confirm installed GStreamer version is 1.24.10 or newer; attempt playback of a test file that previously triggered the null dereference and verify the process no longer crashes.

Typical attack path

1. Craft malicious .mkv/.webm file triggering null codec_priv in matroska demuxer
2. Deliver file via download, email attachment or web page
3. Victim opens file with GStreamer-dependent application
4. gst_matroska_demux_add_wvpk_header dereferences NULL pointer
5. Application crashes, achieving denial of service

How to detect it

Search application and system logs for segmentation faults or crashes originating from libgstreamer or matroska-demux during file processing; correlate crash timestamps with file-open events involving .mkv or .webm containers.

What your security team should do

• Apply the 1.24.10 update to all GStreamer installations within the next patching cycle
• Inventory applications that link against GStreamer and schedule upgrades
• Add GStreamer version checks to build pipelines and container images
• Monitor upstream release notes for any follow-on memory-safety fixes