CVE-2024-47597

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux.c. This issue arises when the function qtdemux_parse_samples reads data beyond the boundaries of the stream->stco buffer. The following code snippet shows the call to qt_atom_parser_get_offset_unchecked, which leads to the OOB-read when parsing the provided GHSL-2024-245_crash1.mp4 file. This issue may lead to read up to 8 bytes out-of-bounds. This vulnerability is fixed in 1.24.10.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
gstreamergstreamer< 1.24.10

References

Timeline

Published
Dec 12, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-475989.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in the qtdemux_meCVE-2024-475997.5GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered inCVE-2024-47606.3A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM 4C/4S/4N/4E, and SAM 3S/3N/3U micCVE-2024-476009.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the format_channCVE-2024-476017.5GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered inCVE-2024-476027.5GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered inCVE-2024-476037.5GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered inCVE-2024-476046.1NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability in its handling of HTML element aCVE-2024-476055.4silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functionality, the linked oEmbCVE-2024-476069.8GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_CVE-2024-476079.8GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_paCVE-2024-476089.8Logicytics is designed to harvest and collect data for forensic analysis. Logicytics has a basic vuln affecting compromised devices from she
CVE-2024-47597: Critical severity, CVSS 9.1 | Vulnix