CVE-2024-47546: GStreamer Buffer Overflow Vulnerability

CVE-2024-47546 Overview

CVE-2024-47546 is an integer underflow vulnerability [CWE-191] in GStreamer, an open-source library used to construct graphs of media-handling components. The flaw resides in the extract_cc_from_data function within qtdemux.c. When processing the FOURCC_c708 case, the subtraction atom_length - 8 underflows if atom_length is less than 8. The resulting large value is passed to g_memdup2, triggering an out-of-bounds read. The issue is fixed in GStreamer version 1.24.10.

Critical Impact
A crafted QuickTime/MP4 media file can trigger an out-of-bounds read in the GStreamer qtdemux element, causing process crashes or potential information disclosure when applications parse untrusted media.

Affected Products

GStreamer versions prior to 1.24.10
Linux distributions packaging vulnerable GStreamer releases (Debian LTS affected)
Applications and media frameworks that link against the vulnerable qtdemux plugin

Discovery Timeline

2024-12-12 - CVE-2024-47546 published to NVD
2026-03-17 - Last updated in NVD database

Technical Details for CVE-2024-47546

Vulnerability Analysis

The vulnerability lives in the QuickTime demuxer (qtdemux.c), which parses MP4 and MOV container atoms. The extract_cc_from_data function handles closed-caption data embedded in media tracks. In the FOURCC_c708 branch, the function calculates the caption payload length by subtracting a fixed header size of 8 from the atom length supplied by the container.

Because atom_length is read directly from attacker-controlled file data without bounds validation, an attacker can supply a value less than 8. The unsigned subtraction wraps around to a very large integer. The resulting *cclen value is then passed to g_memdup2, which copies far beyond the bounds of the source buffer. This produces an out-of-bounds read of adjacent process memory.

Root Cause

The root cause is the absence of a sanity check confirming that atom_length >= 8 before the subtraction. Without this guard, the unsigned integer underflow [CWE-191] propagates into a length parameter consumed by a memory copy primitive, breaking the assumption that cclen represents a valid payload size.

Attack Vector

Exploitation requires the victim to open or process a crafted MP4/MOV file using a GStreamer-based pipeline. The CVSS vector indicates a local attack vector with no privileges or user interaction required beyond loading the file. Successful exploitation primarily impacts availability through process termination, with potential for limited memory disclosure depending on the calling application's handling of the returned buffer.

The vulnerability mechanism in extract_cc_from_data (qtdemux.c, FOURCC_c708 case):

  1. atom_length is read from the container without validation
  2. cclen = atom_length - 8   // unsigned underflow when atom_length < 8
  3. g_memdup2(data, cclen)    // reads massively out-of-bounds

See the GStreamer Security Advisory and merge request 8059 for the
upstream patch that adds the missing length validation.

Detection Methods for CVE-2024-47546

Indicators of Compromise

Unexpected crashes or segmentation faults in processes loading the GStreamer qtdemux element when handling MP4/MOV files
Media-handling daemons or browser helper processes terminating during parsing of untrusted closed-caption tracks
Presence of malformed c708 atoms with atom_length values below 8 in inbound media files

Detection Strategies

Inventory installed GStreamer packages across endpoints and servers, flagging versions prior to 1.24.10
Inspect crash dumps from media players, transcoders, and thumbnailers for stack frames involving extract_cc_from_data or qtdemux
Apply static or fuzzing analysis to media ingestion pipelines that process user-supplied MP4/MOV content

Monitoring Recommendations

Monitor process telemetry for repeated crashes of GStreamer-based applications correlated with media file ingestion
Track package management events on Linux fleets to confirm rollout of the patched 1.24.10 release or distribution backports
Alert on outbound transfers of large media buffers from media-handling services that could indicate information disclosure exploitation

How to Mitigate CVE-2024-47546

Immediate Actions Required

Upgrade GStreamer to version 1.24.10 or later on all affected systems
Apply distribution updates such as the Debian LTS advisory for systems running older GStreamer branches
Restrict processing of untrusted MP4/MOV files in server-side media pipelines until patching completes

Patch Information

The upstream fix is published as GitLab Merge Request 8059 and detailed in the GStreamer Security Advisory SA-2024-0013. Additional context is available in the GitHub Security Lab advisory GHSL-2024-243 and the Debian LTS announcement. The patch adds a length validation check before computing cclen, preventing the underflow.

Workarounds

Disable or blacklist the qtdemux element where MP4/MOV parsing is not required
Sandbox media-handling processes using seccomp, namespaces, or equivalent OS isolation to contain crashes and limit memory exposure
Pre-validate media files with a hardened parser before passing them to GStreamer pipelines

bash

# Verify installed GStreamer version on Debian/Ubuntu
dpkg -l | grep gstreamer1.0-plugins-good

# Upgrade to a patched release
sudo apt update && sudo apt install --only-upgrade \
    gstreamer1.0-plugins-good libgstreamer-plugins-good1.0-0

# Confirm the runtime version is 1.24.10 or later
gst-inspect-1.0 --version