CVE-2024-47544: GStreamer Null Dereference Vulnerability

CVE-2024-47544 Overview

CVE-2024-47544 is a null pointer dereference vulnerability [CWE-476] in GStreamer, the open-source multimedia framework used to build pipelines for media-handling components. The flaw resides in the qtdemux_parse_sbgp function within qtdemux.c, which parses the Sample-to-Group (sbgp) box in QuickTime and ISO Base Media File Format containers. A crafted media file triggers a null dereference during parsing, causing the process consuming the file to crash. The issue is fixed in GStreamer 1.24.10. Exploitation requires local user interaction to open or process a malicious file through an application that links against GStreamer.

Critical Impact
A malicious QuickTime/MP4-style file can crash any application that uses GStreamer's qtdemux element, resulting in denial of service on the local user session.

Affected Products

GStreamer versions prior to 1.24.10
Applications and Linux distributions bundling vulnerable qtdemux plugins (e.g., Debian LTS)
Media players, browsers, and desktop environments relying on GStreamer for QuickTime/MP4 demuxing

Discovery Timeline

2024-12-12 - CVE-2024-47544 published to NVD
2026-03-17 - Last updated in NVD database

Technical Details for CVE-2024-47544

Vulnerability Analysis

The vulnerability sits in qtdemux_parse_sbgp, the routine that processes the Sample-to-Group (sbgp) atom in ISO Base Media File Format streams. When qtdemux encounters a malformed or unexpected sbgp structure, the function dereferences a pointer that was never initialized or was returned as NULL from a prior lookup. The dereference happens in-process, terminating the host application with a segmentation fault. Because GStreamer is embedded in many Linux desktop applications, the blast radius extends well beyond standalone media players.

The weakness maps to [CWE-476: NULL Pointer Dereference]. Impact is limited to availability — the issue does not provide a path to memory corruption, code execution, or information disclosure based on the published advisories.

Root Cause

The root cause is missing validation of a pointer returned from internal sample-group bookkeeping before it is dereferenced inside qtdemux_parse_sbgp. The function assumed a related structure would always be present for any well-formed sbgp entry. A crafted file omits or reorders the dependent boxes, leaving the pointer NULL when the code attempts to read fields from it.

Attack Vector

An attacker delivers a malicious .mov, .mp4, or related container to a victim. The victim opens the file in any application that routes media through GStreamer's qtdemux (file managers with thumbnailers, GNOME/KDE players, web browsers using GStreamer backends). User interaction is required, and the attack runs locally with no privileges needed.

No synthetic exploit code is reproduced here. The fix is published as a merge request on the GStreamer GitLab repository — see the GitLab Patch Merge Request and GStreamer Security Advisory SA-2024-0011 for the precise code change.

Detection Methods for CVE-2024-47544

Indicators of Compromise

Repeated SIGSEGV crashes of GStreamer-backed processes such as totem, rhythmbox, gst-launch-1.0, gst-discoverer-1.0, or tracker-extract
Core dumps with crash frames inside qtdemux_parse_sbgp or neighboring qtdemux.c symbols
Unexpected .mov/.mp4 files dropped into user-writable paths (~/Downloads, mail attachment caches, web cache directories) shortly before crash events

Detection Strategies

Inventory installed GStreamer plugin packages and flag any version below 1.24.10 on managed Linux endpoints
Hunt application crash telemetry for stack traces containing qtdemux symbols across the fleet
Correlate media-file write events from email or browser processes with subsequent crashes of media-handling helpers

Monitoring Recommendations

Forward systemd-coredump and journalctl crash events into a central log pipeline for cross-host correlation
Track package version drift for gstreamer1.0-plugins-good (or distribution equivalent) and alert on hosts that remain on vulnerable builds
Monitor automated file-preview and thumbnail services for abnormal restart loops, a common symptom of repeated qtdemux crashes

How to Mitigate CVE-2024-47544

Immediate Actions Required

Upgrade GStreamer to version 1.24.10 or later on all affected hosts
Apply distribution security updates, including the Debian LTS fix referenced in the Debian LTS Announcement
Restart long-running services and desktop sessions after patching so updated plugins are loaded
Restrict opening of untrusted .mov and .mp4 files until patching is verified

Patch Information

The upstream fix is published as merge request 8059 in the GStreamer GitLab repository and shipped in release 1.24.10. Review the GitHub Security Advisory GHSL-2024-238 for the GitHub Security Lab analysis and the GStreamer Security Advisory SA-2024-0011 for vendor guidance.

Workarounds

Disable or remove the qtdemux plugin on systems that do not require QuickTime/MP4 playback until patches are applied
Block delivery of QuickTime and MP4 attachments at the mail gateway for high-risk user groups
Strip or sandbox file thumbnailers and preview helpers that automatically invoke GStreamer on downloaded content

bash

# Verify GStreamer version and remove vulnerable qtdemux plugin if patching is delayed
gst-inspect-1.0 --version
gst-inspect-1.0 qtdemux | head -n 5

# Debian/Ubuntu: install the fixed package
sudo apt update && sudo apt install --only-upgrade \
  gstreamer1.0-plugins-good libgstreamer1.0-0

# Temporary mitigation: disable qtdemux by moving the plugin out of the registry path
sudo mv /usr/lib/x86_64-linux-gnu/gstreamer-1.0/libgstisomp4.so \
        /usr/lib/x86_64-linux-gnu/gstreamer-1.0/libgstisomp4.so.disabled
rm -f ~/.cache/gstreamer-1.0/registry.x86_64.bin