CVE-2024-47774

What it actually does

The gst_avi_subtitle_parse_gab2_chunk function reads an unchecked name_length value from an AVI subtitle chunk; when the value exceeds 0xFFFFFFFF-17 an integer overflow occurs and the subsequent memory access reads past the end of the input buffer.

Why it matters to the business

Applications that process untrusted AVI files with GStreamer may crash or leak memory contents, disrupting media workflows and potentially exposing sensitive data from the process address space.

How an attack unfolds

An attacker crafts an AVI file containing a GAB2 subtitle chunk whose name_length field is chosen to trigger the integer overflow. When a vulnerable GStreamer-based application parses the file the overflowed length calculation allows an out-of-bounds read from the supplied buffer.

How to fix it

Upgrade GStreamer to version 1.24.10 or apply commit 5be4b6f03689ab438822f6cfcd13f1f300afe203; rebuild and redeploy any dependent packages that statically link the library.

How to confirm the fix worked

Confirm the installed GStreamer version reports 1.24.10 or newer; run regression tests that feed AVI files with name_length values near 0xFFFFFFFF-17 and verify no out-of-bounds access occurs.

Typical attack path

1. Attacker creates a specially crafted AVI file with an oversized name_length in the GAB2 subtitle chunk
2. Attacker delivers the file via download, email attachment, or media library
3. Victim application using an affected GStreamer version opens or indexes the file
4. gst_avi_subtitle_parse_gab2_chunk performs the unchecked arithmetic and reads beyond the buffer
5. Process crashes or memory contents are disclosed to the attacker

How to detect it

Review process crash logs and core dumps for faults inside gstavisubtitle.c or the GAB2 parsing path; correlate file-open events on AVI containers with subsequent segmentation faults or abnormal memory access in GStreamer-based processes.

What your security team should do

• Patch GStreamer installations to 1.24.10 or the listed commit within the next maintenance window
• Inventory all media-processing services and containers that depend on GStreamer
• Add GStreamer version checks to automated build and deployment pipelines
• Monitor for new public exploits or EPSS increases over the next 30 days