CVE-2024-47542

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference has been discovered in the id3v2_read_synch_uint function, located in id3v2.c. If id3v2_read_synch_uint is called with a null work->hdr.frame_data, the pointer guint8 *data is accessed without validation, resulting in a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125 CWE-476

Affected software

Vendor	Product	Versions
gstreamer	gstreamer	< 1.24.10

References

https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8033.patchPatch
https://gstreamer.freedesktop.org/security/sa-2024-0008.htmlPatch, Release Notes, Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2024-235_Gstreamer/Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/12/msg00021.html

Timeline

Published: Dec 12, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-475437.5GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in qtdemux_parse_CVE-2024-475447.5GStreamer is a library for constructing graphs of media-handling components. The function qtdemux_parse_sbgp in qtdemux.c is affected by a n CVE-2024-475457.5GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak fu CVE-2024-475467.5GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in extract_cc_from_data CVE-2024-475479.8Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which lea CVE-2024-475496.1Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP re CVE-2024-47554.8The Google CSE WordPress plugin through 1.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2024-475506.7Incorrect default permissions for some Endurance Gaming Mode software installers may allow an authenticated user to potentially enable escal CVE-2024-475529.8Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): from 2.0.0 CVE-2024-475539.9A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate u CVE-2024-475544.3Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively CVE-2024-475558.3Missing Authentication - User & System Configuration