CVE-2024-47545: GStreamer Buffer Overflow Vulnerability

CVE-2024-47545 Overview

CVE-2024-47545 is an integer underflow vulnerability in GStreamer, the open-source multimedia framework used by Linux desktop environments, media players, and embedded systems. The flaw resides in the qtdemux_parse_trak function within qtdemux.c. During strf parsing, the operation size -= 40 underflows when size is less than 40, producing a large unsigned value. The subsequent call to gst_buffer_fill then invokes memcpy with an oversized tocopy argument, triggering an out-of-bounds read. Maintainers fixed the issue in GStreamer 1.24.10. The weakness is classified as [CWE-191] Integer Underflow.

Critical Impact
A crafted QuickTime or MP4 file can trigger an out-of-bounds memory read in any application that uses the GStreamer qtdemux element, potentially crashing the process or leaking memory contents.

Affected Products

GStreamer versions prior to 1.24.10
Linux distributions shipping vulnerable GStreamer packages, including Debian LTS
Applications depending on the qtdemux plugin for QuickTime/MP4 parsing

Discovery Timeline

2024-12-12 - CVE-2024-47545 published to NVD
2026-03-17 - Last updated in NVD database

Technical Details for CVE-2024-47545

Vulnerability Analysis

The vulnerability lives in the QuickTime demuxer (qtdemux), which parses MOV and MP4 container atoms. While handling the strf (stream format) case inside qtdemux_parse_trak, the code subtracts a fixed header length of 40 bytes from the remaining size value without first validating that size >= 40. When an attacker-controlled atom reports a size below 40, the unsigned subtraction wraps around to a value near SIZE_MAX.

The wrapped value is then passed to gst_buffer_fill, which internally calls memcpy with the attacker-influenced length. The copy reads far past the bounds of the source buffer, producing an out-of-bounds read. Depending on heap layout, the process may crash or expose adjacent memory to a downstream pipeline element. The attack vector is local because the victim must process a malicious media file, but pipelines that automatically demux untrusted content broaden the exposure.

Root Cause

The root cause is missing bounds validation on a length field before unsigned arithmetic. The strf handler trusts the on-disk size value and performs size -= 40 without enforcing the minimum length precondition, violating safe integer handling practices.

Attack Vector

Exploitation requires an application using GStreamer's qtdemux element to open a crafted MP4, MOV, or AVI-style file containing a malformed strf atom whose declared size is less than 40 bytes. Once the demuxer parses the atom, the underflow propagates into the buffer-fill path and triggers the oversized memcpy. No authentication or privilege is required; user interaction to open the file is sufficient.

No verified public exploit is currently available. Refer to the GitHub Security Advisory GHSL-2024-242 and the GStreamer Security Advisory 2024-0010 for technical details.

Detection Methods for CVE-2024-47545

Indicators of Compromise

Unexpected crashes of GStreamer-based applications such as gst-launch-1.0, totem, rhythmbox, or browsers using gstreamer backends after opening media files
Segmentation faults logged by the kernel referencing libgstisomp4.so or qtdemux
Receipt of MP4 or MOV files from untrusted sources containing malformed strf atoms with declared sizes below 40 bytes

Detection Strategies

Inventory installed GStreamer versions across Linux endpoints and flag any release earlier than 1.24.10
Hunt for process crashes whose backtrace includes qtdemux_parse_trak or gst_buffer_fill
Use file-format inspection tools to identify QuickTime atoms with abnormally small declared lengths inside the strf chunk

Monitoring Recommendations

Forward coredumpctl and journald records for media-handling processes to a central log store for correlation
Monitor package management events for upgrades and downgrades of gstreamer1.0-plugins-good and related packages
Alert on media files arriving through email, web download, or chat that fail format validation prior to playback

How to Mitigate CVE-2024-47545

Immediate Actions Required

Upgrade GStreamer to version 1.24.10 or later on every affected host
Apply distribution security updates, including the fix shipped via the Debian LTS Announcement
Restrict opening of untrusted MP4, MOV, and related container files until patches are deployed

Patch Information

The upstream fix is available in the GitLab Patch Merge Request 8059 and is included in GStreamer 1.24.10. The patch validates the remaining size value before performing the 40-byte subtraction, preventing the unsigned underflow. Vendor packaging details are tracked in the GStreamer Security Advisory 2024-0010.

Workarounds

Disable or remove the qtdemux plugin where QuickTime parsing is not required
Sandbox media-handling applications using bubblewrap, firejail, or seccomp profiles to limit the blast radius of a memory disclosure
Block delivery of QuickTime and MP4 attachments at email and web gateways until patching completes

bash

# Verify installed GStreamer version and upgrade on Debian-based systems
dpkg -l | grep -E 'gstreamer1.0-plugins-(good|bad|ugly|base)'
sudo apt update
sudo apt install --only-upgrade \
  gstreamer1.0-plugins-good \
  gstreamer1.0-plugins-bad \
  gstreamer1.0-plugins-base

# Confirm patched version (1.24.10 or later)
gst-inspect-1.0 --version