CVE-2024-47596

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in the qtdemux_parse_svq3_stsd_data function within qtdemux.c. In the FOURCC_SMI_ case, seqh_size is read from the input file without proper validation. If seqh_size is greater than the remaining size of the data buffer, it can lead to an OOB-read in the following call to gst_buffer_fill, which internally uses memcpy. This vulnerability can result in reading up to 4GB of process memory or potentially causing a segmentation fault (SEGV) when accessing invalid memory. This vulnerability is fixed in 1.24.10.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
gstreamergstreamer< 1.24.10

References

Timeline

Published
Dec 12, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-475979.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samCVE-2024-475989.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in the qtdemux_meCVE-2024-475997.5GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered inCVE-2024-47606.3A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM 4C/4S/4N/4E, and SAM 3S/3N/3U micCVE-2024-476009.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the format_channCVE-2024-476017.5GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered inCVE-2024-476027.5GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered inCVE-2024-476037.5GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered inCVE-2024-476046.1NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability in its handling of HTML element aCVE-2024-476055.4silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functionality, the linked oEmbCVE-2024-476069.8GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_CVE-2024-476079.8GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_pa
CVE-2024-47596: High severity, CVSS 7.5 | Vulnix