CVE-2024-47542 Overview
CVE-2024-47542 is a null pointer dereference vulnerability in GStreamer, an open-source library used to construct graphs of media-handling components. The flaw resides in the id3v2_read_synch_uint function within id3v2.c. When the function is invoked with a null work->hdr.frame_data, the guint8 *data pointer is accessed without validation, triggering a segmentation fault (SEGV). An attacker can exploit this issue by supplying a malformed ID3v2-tagged media file, causing the consuming application to crash. The vulnerability is fixed in GStreamer 1.24.10.
Critical Impact
Processing a crafted media file leads to a Denial of Service (DoS) condition in any application that relies on GStreamer for media parsing.
Affected Products
- GStreamer versions prior to 1.24.10
- Linux distributions packaging vulnerable GStreamer builds, including Debian LTS
- Desktop and server applications embedding GStreamer for media handling
Discovery Timeline
- 2024-12-12 - CVE-2024-47542 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-47542
Vulnerability Analysis
The vulnerability is a null pointer dereference [CWE-125] inside the ID3v2 tag parser of GStreamer. The id3v2_read_synch_uint function reads a synchronized unsigned integer from an ID3v2 frame buffer. The function expects the caller to provide a valid pointer to frame data through work->hdr.frame_data. The parser fails to verify that this pointer is non-null before dereferencing it. A crafted ID3v2 tag can reach the parser path where frame_data remains null, resulting in a segmentation fault. The crash occurs in the media processing thread, terminating the host application.
Root Cause
The root cause is missing input validation in the ID3v2 frame parsing routine. The function operates directly on guint8 *data derived from work->hdr.frame_data without a preceding null check. Malformed or truncated ID3v2 headers can leave frame_data uninitialized for that code path, exposing the unchecked dereference.
Attack Vector
Exploitation requires user interaction. An attacker delivers a crafted audio or video file containing a malformed ID3v2 tag. When a user opens the file in a media player or application built on GStreamer, the parser dereferences the null pointer and the process crashes. The attack vector is local, and the impact is limited to availability. Code execution has not been demonstrated. Refer to the GStreamer Security Advisory and the GitHub Security Advisory GHSL-2024-235 for additional technical context.
Detection Methods for CVE-2024-47542
Indicators of Compromise
- Unexpected crashes of media applications or services that load files containing ID3v2 metadata
- Segmentation fault (SIGSEGV) entries in system logs originating from processes linked against libgstreamer
- Core dumps showing a faulting instruction inside id3v2_read_synch_uint or callers within id3v2.c
Detection Strategies
- Inventory installed GStreamer packages and flag versions earlier than 1.24.10
- Monitor journald, dmesg, and application logs for repeated SEGV events tied to GStreamer-based binaries
- Inspect untrusted media files for malformed ID3v2 headers using static analysis utilities such as mutagen or id3v2
Monitoring Recommendations
- Alert on crash loops in services that automatically process user-supplied media (transcoders, indexers, thumbnailers)
- Track file-open telemetry from media players opening files originating from email, web downloads, or removable media
- Correlate process termination events with the SHA-256 hash of the input file to identify recurring malicious samples
How to Mitigate CVE-2024-47542
Immediate Actions Required
- Upgrade GStreamer to version 1.24.10 or later on all affected hosts
- Apply distribution updates such as the fix referenced in the Debian LTS Announcement
- Restrict processing of untrusted media files in automated pipelines until patches are deployed
Patch Information
The upstream fix adds validation before dereferencing the frame data pointer in id3v2_read_synch_uint. The patch is available as a merge request from the GStreamer project. See the GitLab Patch Proposal and the consolidated GStreamer Security Advisory SA-2024-0008.
Workarounds
- Disable or remove the ID3 demuxer plugin in deployments that do not require ID3v2 metadata parsing
- Sandbox media-processing workloads using seccomp, bubblewrap, or containerization to contain crashes
- Block delivery of unsolicited audio and video attachments at email and web gateways until patches are applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
