CVE-2024-47596: GStreamer Buffer Overflow Vulnerability

CVE-2024-47596 Overview

CVE-2024-47596 is an out-of-bounds read vulnerability in GStreamer, an open-source library for constructing graphs of media-handling components. The flaw resides in the qtdemux_parse_svq3_stsd_data function within qtdemux.c. When parsing the FOURCC_SMI_ case, the parser reads seqh_size from a user-supplied file without validating it against the remaining data buffer size. A crafted media file triggers an out-of-bounds read through gst_buffer_fill, which internally calls memcpy. Exploitation can leak up to 4GB of process memory or produce a segmentation fault. The issue is fixed in GStreamer 1.24.10.

Critical Impact
A crafted QuickTime/MOV file processed by an application using GStreamer can leak process memory or crash the media pipeline via an out-of-bounds read [CWE-125].

Affected Products

GStreamer versions prior to 1.24.10
qtdemux element within gst-plugins-good
Applications and desktop environments embedding vulnerable GStreamer builds (including Debian LTS distributions)

Discovery Timeline

2024-12-12 - CVE-2024-47596 published to NVD
2024-12-12 - GStreamer Security Advisory SA-2024-0015 released with fix in 1.24.10
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47596

Vulnerability Analysis

The vulnerability lives in the QuickTime demuxer (qtdemux) shipped in gst-plugins-good. The qtdemux_parse_svq3_stsd_data function handles Sorenson Video 3 sample description atoms. Inside the FOURCC_SMI_ branch, the parser extracts seqh_size directly from the input file and passes it to gst_buffer_fill without confirming that the value fits within the remaining data buffer.

Because gst_buffer_fill wraps memcpy, oversized seqh_size values cause the copy operation to read past the source buffer boundary. The read can traverse adjacent process memory up to a 4GB window or terminate the process with a SEGV when it hits unmapped pages. The impact is limited to information disclosure and denial of service; the researcher did not report memory corruption or code execution.

Root Cause

The root cause is missing bounds validation on an attacker-controlled length field parsed from an untrusted media container. The seqh_size value must be compared against the remaining size of the data buffer before it is used as the length argument to a memory copy. Its absence classifies the defect as an out-of-bounds read [CWE-125].

Attack Vector

An attacker crafts a malicious QuickTime/MOV file containing a manipulated Sorenson Video 3 sample description atom with an oversized seqh_size. The victim must open or preview the file with an application that dispatches the stream through GStreamer's qtdemux. This is a local attack vector requiring user interaction with the file, such as through a media player, thumbnailer, or file manager preview handler.

No public proof-of-concept exploit or CISA KEV listing exists for this CVE at the time of writing. See the GitHub Security Advisory GHSL-2024-244 for the vendor-published technical description.

Detection Methods for CVE-2024-47596

Indicators of Compromise

Unexpected crashes or segmentation faults in processes loading libgstqtdemux or gst-plugins-good shared objects
Media player, thumbnailer, or tracker-extract processes terminating when handling QuickTime/MOV files from untrusted sources
MOV/MP4 files containing malformed Sorenson Video 3 (FOURCC_SMI_) sample description atoms with oversized seqh_size fields

Detection Strategies

Inventory installed GStreamer packages and flag versions of gst-plugins-good older than 1.24.10
Parse MOV/MP4 files at ingest points and reject atoms where seqh_size exceeds the enclosing box size
Correlate crash telemetry (SIGSEGV) with GStreamer loader stacks to identify exploitation attempts

Monitoring Recommendations

Alert on repeated abnormal terminations of media pipeline processes such as totem, rhythmbox, tracker-extract, or gst-launch-1.0
Monitor endpoints and file servers for inbound MOV/MP4 attachments from untrusted email and web sources
Track package management events for GStreamer upgrades to confirm the fixed version 1.24.10 is deployed fleet-wide

How to Mitigate CVE-2024-47596

Immediate Actions Required

Upgrade GStreamer to version 1.24.10 or later on all Linux, macOS, and Windows systems that ship it
Apply distribution security updates, including the Debian LTS Announcement for affected Debian releases
Restrict automated media indexing and preview handlers for files originating from untrusted sources until patches are deployed

Patch Information

The upstream fix is available in the GitLab Merge Request Patch and consolidated in the GStreamer Security Advisory SA-2024-0015. The patch adds a bounds check comparing seqh_size against the remaining buffer length before calling gst_buffer_fill. Downstream distributions such as Debian have backported the fix; verify installed package versions match the vendor's advisory.

Workarounds

Disable or blacklist the qtdemux element in GStreamer where MOV/MP4 playback is not required
Sandbox media-handling processes using bubblewrap, firejail, or systemd unit hardening to contain information disclosure
Block MOV/MP4 attachments at email gateways and web proxies for high-risk user groups until patching is complete

bash

# Verify installed GStreamer version and upgrade on Debian-based systems
dpkg -l | grep gstreamer1.0-plugins-good
apt update && apt install --only-upgrade gstreamer1.0-plugins-good

# Confirm the patched version is 1.24.10 or later
gst-inspect-1.0 --version