CVE-2024-47541: GStreamer Buffer Overflow Vulnerability

CVE-2024-47541 Overview

CVE-2024-47541 is an out-of-bounds write vulnerability in GStreamer, an open-source library for building media-handling pipelines. The flaw resides in the gst_ssa_parse_remove_override_codes function within gstssaparse.c, which parses SubStation Alpha (SSA) subtitle style override codes enclosed in curly brackets. When a malformed input places a closing brace } before an opening brace {, the parser miscalculates memory offsets and writes past the allocated buffer. GStreamer maintainers fixed the defect in version 1.24.10. The vulnerability is classified under [CWE-787] (Out-of-bounds Write).

Critical Impact
Processing a crafted SSA subtitle file through a GStreamer pipeline can corrupt heap memory, resulting in application crashes and potential availability loss for media applications built on the library.

Affected Products

GStreamer versions prior to 1.24.10
Applications and desktop environments embedding vulnerable GStreamer builds
Linux distributions shipping affected GStreamer packages (including Debian LTS)

Discovery Timeline

2024-12-12 - CVE-2024-47541 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47541

Vulnerability Analysis

The defect exists in gst_ssa_parse_remove_override_codes, a routine responsible for stripping SSA style override sequences from subtitle text. SSA override codes are delimited by matching { and } characters. The parser scans the input string, locates each pair, and uses memmove() to remove the enclosed content in place.

The function fails to validate that an opening { appears before a closing }. When a closing brace precedes any opening brace, the parser derives an incorrect end pointer and passes an oversized length to memmove(). On each loop iteration, the value of strlen(end+1) grows relative to the remaining buffer, causing successive copies to extend further beyond the destination bounds.

Because the write occurs on heap-allocated buffers holding subtitle text, an attacker who supplies a crafted SSA stream can corrupt adjacent heap metadata or objects. The immediate consequence is memory corruption within the media pipeline process.

Root Cause

The root cause is missing bounds and ordering validation on delimiter tokens. The parser assumes well-formed SSA input and does not confirm the relative position of { and } before computing a memmove() length, violating the invariant that source and destination lengths remain within the allocated buffer.

Attack Vector

Exploitation requires the target to open or process a malicious SSA subtitle file, or a media container that references one, through a GStreamer-based application. The attack vector is local: an attacker must deliver the crafted subtitle content to a user or automated processing pipeline. No authentication or privilege is required beyond the ability to supply subtitle input to a vulnerable decoder.

See the GitHub Security Advisory GHSL-2024-228 for the technical description of the parsing flow and the GitLab merge request 8036 patch for the corrected logic.

Detection Methods for CVE-2024-47541

Indicators of Compromise

Unexpected crashes or SIGABRT/SIGSEGV signals in processes linked against libgstsubparse or libgstreamer-1.0 when handling subtitle content
Presence of .ssa or .ass subtitle files containing malformed override sequences where } appears before {
Heap corruption diagnostics from glibc (for example, malloc(): corrupted top size) in media applications

Detection Strategies

Inventory installed GStreamer versions across Linux and containerized workloads and flag any release prior to 1.24.10
Inspect SSA/ASS subtitle files with static parsers to detect malformed brace ordering before submission to GStreamer pipelines
Enable AddressSanitizer or Valgrind on media processing services in test environments to surface out-of-bounds writes triggered by fuzzed subtitle inputs

Monitoring Recommendations

Alert on repeated crashes of media player, transcoding, or streaming daemons that link against GStreamer plugins
Correlate subtitle-file downloads or uploads with subsequent process termination events on user endpoints
Track package manager events showing downgrades or pinned versions of gstreamer1.0-plugins-base and related packages

How to Mitigate CVE-2024-47541

Immediate Actions Required

Upgrade GStreamer to version 1.24.10 or later on all systems where the library is installed
Apply distribution security updates, including the fixes referenced in the Debian LTS Announcement
Restrict processing of untrusted .ssa and .ass subtitle files in automated media pipelines until patches are applied

Patch Information

The fix is committed in GStreamer 1.24.10. Review the GStreamer Security Advisory SA-2024-0023 and apply the corresponding patch from the GitLab merge request 8036. Distribution maintainers have backported the fix to supported LTS branches.

Workarounds

Disable or unload the subparse plugin in environments that do not require SSA/ASS subtitle handling
Filter subtitle streams at ingress and reject files with unbalanced or inverted {/} sequences
Run media processing components in sandboxed or isolated containers to limit the impact of heap corruption

bash

# Verify installed GStreamer version and check for the subparse plugin
gst-inspect-1.0 --version
gst-inspect-1.0 subparse | head -n 20

# On Debian/Ubuntu systems, apply security updates
sudo apt-get update
sudo apt-get install --only-upgrade \
  libgstreamer1.0-0 \
  gstreamer1.0-plugins-base \
  gstreamer1.0-plugins-good