CVE-2024-47776

What it actually does

Out-of-bounds read in gst_wavparse_cue_chunk caused by incorrect chunk size clipping that allows a loop to access memory past the allocated buffer, resulting in either a crash or disclosure of adjacent memory contents.

Why it matters to the business

Applications that parse untrusted WAV files can be forced to terminate or leak memory contents; the issue affects any product that embeds or links against the vulnerable GStreamer library, increasing operational risk for media-processing pipelines.

How an attack unfolds

An attacker supplies a specially crafted WAV file containing a cue chunk whose declared size is inconsistent with the actual buffer length delivered by the upstream element. When the parser reaches the cue-chunk handler, the flawed size check passes, the subsequent loop reads past the buffer, and the process either crashes or returns sensitive data to the attacker.

How to fix it

Upgrade GStreamer to version 1.24.10 or later; rebuild any dependent packages against the fixed commit 5be4b6f03689ab438822f6cfcd13f1f300afe203; rebuild and redeploy affected containers or distributions.

How to confirm the fix worked

Confirm the installed GStreamer library reports version 1.24.10 or newer; run the upstream test suite with the provided cue-chunk regression test; verify that the wavparse element no longer crashes on the supplied proof-of-concept file.

Typical attack path

1. Attacker crafts a malicious WAV file with a malformed cue chunk
2. Victim application opens the file using GStreamer’s wavparse element
3. Parser miscalculates the chunk size and enters an out-of-bounds read loop
4. Process crashes (DoS) or returns leaked memory to the caller
5. Attacker repeats or chains the crash to disrupt service or exfiltrate data

How to detect it

Search application and system logs for segmentation faults or abnormal exits originating from libgstreamer while processing .wav files; inspect core dumps or memory dumps for evidence of reads beyond wavparse buffers; correlate file-open events with subsequent crashes.

What your security team should do

• Immediately update all GStreamer installations to 1.24.10 or newer
• Scan build pipelines and container images for the vulnerable library version
• Add WAV parsing to the list of untrusted input surfaces requiring strict sandboxing
• Monitor for new EPSS or KEV entries and reassess urgency if exploitation is observed