CVE-2024-47777

What it actually does

Out-of-bounds read of 4 bytes in gst_wavparse_smpl_chunk caused by reading from data+12 without verifying the input buffer length in the WAV parser.

Why it matters to the business

Applications that process untrusted media files may crash or leak small amounts of adjacent memory, disrupting media pipelines and requiring urgent patching of a widely used library.

How an attack unfolds

An attacker supplies a specially crafted WAV file whose smpl chunk has a data buffer smaller than 16 bytes; when the parser reaches gst_wavparse_smpl_chunk it performs an unchecked read past the allocation, resulting in memory corruption.

How to fix it

Upgrade GStreamer to the fixed commit 5be4b6f03689ab438822f6cfcd13f1f300afe203 (equivalent to release 1.24.10) or later; rebuild and redeploy all dependent applications and containers.

How to confirm the fix worked

Confirm the running GStreamer version reports 1.24.10 or newer; recompile with the patch and verify that a minimal malformed WAV no longer triggers the read beyond the buffer.

Typical attack path

1. Deliver a malicious WAV file to any GStreamer-based media handler
2. Trigger parsing of the smpl chunk via normal file open or decode operations
3. Cause the out-of-bounds read at offset +12 inside gst_wavparse_smpl_chunk
4. Observe crash, information disclosure, or continued execution with corrupted state

How to detect it

Look for segmentation faults or memory-access violations in processes that use libgstreamer while handling WAV files; correlate with file-open events for recently received media.

What your security team should do

• Immediately update all GStreamer installations to the patched commit or 1.24.10
• Scan build pipelines and container images for the vulnerable library version
• Add automated regression tests that feed malformed WAV files to the parser
• Monitor for application crashes during media ingestion until patching is complete