CVE-2024-47606

What it actually does

Integer underflow in qtdemux_parse_theora_extension causes the gint size variable to underflow, leading to a small allocation via gst_buffer_new_and_alloc, followed by memcpy that overwrites the GstMapInfo structure and enables function pointer hijack in gst_memory_unmap for arbitrary code execution.

Why it matters to the business

Attackers can execute arbitrary code on systems that process untrusted media files using GStreamer, resulting in full system compromise, data breaches, or deployment of malware across media-handling applications and pipelines.

How an attack unfolds

An attacker supplies a specially crafted media file containing malformed Theora extension data. During parsing in qtdemux, the underflow produces an undersized buffer; the subsequent memcpy corrupts the GstMapInfo structure, and the call to gst_memory_unmap triggers execution of attacker-controlled code via the overwritten function pointer.

How to fix it

Upgrade GStreamer to version 1.24.10 or later, or apply commit 5be4b6f03689ab438822f6cfcd13f1f300afe203. Until patched, restrict processing of untrusted media files and consider sandboxing or disabling Theora/QuickTime demuxing where possible.

How to confirm the fix worked

Confirm the installed GStreamer version is 1.24.10 or newer; verify the presence of the fix commit in source builds; test parsing of known-malformed media samples in a controlled environment to ensure no crash or code execution occurs.

Typical attack path

1. Craft malicious media file embedding oversized or malformed Theora extension data
2. Deliver the file to a target application or service that uses GStreamer for media parsing
3. Trigger qtdemux parsing of the file
4. Exploit the underflow to cause undersized allocation and memory corruption
5. Hijack execution flow through the corrupted function pointer during unmap

How to detect it

Review application and system logs for crashes or errors originating from qtdemux or gst_buffer operations during media file processing; inspect for unexpected memory corruption symptoms or abnormal allocation sizes in debug traces; correlate file processing events with subsequent suspicious process behavior.

What your security team should do

• Immediately update all GStreamer installations to the fixed version 1.24.10
• Inventory and prioritize patching of high-exposure media processing services
• Implement strict input validation or sandboxing for untrusted media until updates are complete
• Monitor EPSS and threat intelligence for any increase in exploitation activity