# CVE-2024-47606: GHSL-2024-166: GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that can lead to out-of-bounds writes Status: published. Published: 2024-12-11. Updated: 2026-11-03. GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst_buffer_new_and_alloc. The function gst_buffer_new_allocate then attempts to allocate memory, eventually calling _sysmem_new_block. The function _sysmem_new_block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice_size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst_buffer_fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst_memory_unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem_unmap_full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10. ## Remediation - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: security-advisories@github.com) — https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8032.patch ## Affected products and versions - gstreamer / gstreamer: < 1.24.10 (affected). Source: CNA: GitHub_M ## NVD configuration conditions Affected CPE matches depend on the following AND/OR and negation conditions: ```json [ { "negate": false, "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.24.10", "vulnerable": true } ], "negate": false, "operator": "OR" } ], "operator": "OR" }, { "negate": false, "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "vulnerable": true } ], "negate": false, "operator": "OR" } ], "operator": "OR" } ] ``` ## Severity and prioritization - CVSS 4.0: 8.6 (high); CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; source: CNA: GitHub_M - CVSS 4.0: 8.6 (high); CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: security-advisories@github.com - CVSS 3.1: 9.8 (critical); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; source: NVD: nvd@nist.gov - CISA KEV: No listing in collected sources - EPSS: 1.73% as of 2026-11-03; percentile 77.60% - SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP - Weaknesses: CWE-190, CWE-191 ## Exploit evidence No exploit evidence in collected sources. This is not proof of no exploitation. ## References - https://securitylab.github.com/advisories/GHSL-2024-166_Gstreamer/ (CNA: GitHub_M; x_refsource_CONFIRM) - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8032.patch (CNA: GitHub_M; x_refsource_MISC) - https://gstreamer.freedesktop.org/security/sa-2024-0014.html (CNA: GitHub_M; x_refsource_MISC) - https://lists.debian.org/debian-lts-announce/2024/12/msg00016.html (ADP: CVE) - https://security.netapp.com/advisory/ntap-20250418-0003/ (ADP: CVE) - https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html (ADP: CVE) - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8032.patch (security-advisories@github.com; Patch) - https://gstreamer.freedesktop.org/security/sa-2024-0014.html (security-advisories@github.com; Release Notes) - https://securitylab.github.com/advisories/GHSL-2024-166_Gstreamer/ (security-advisories@github.com; Third Party Advisory) - https://lists.debian.org/debian-lts-announce/2024/12/msg00016.html (af854a3a-2127-422b-91ae-364da2661108; Mailing List) - https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html (af854a3a-2127-422b-91ae-364da2661108) - https://security.netapp.com/advisory/ntap-20250418-0003/ (af854a3a-2127-422b-91ae-364da2661108) ## Provenance - CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2024-47606; retrieved 2026-11-03; source updated 2026-11-03 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-47606; retrieved 2026-11-04; source updated 2026-11-03 - FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2024-47606; retrieved 2026-11-03; source updated Not reported Revision: e85017802a5213615e8662655ddb58fed518da338c20c1f2363c2391b0d205fd Canonical: https://y2.dev/cve/CVE-2024-47606 ## Agent and API access Public CVE pages, Markdown, and JSON are free to read without an account or API key. - Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end. - WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers. - Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}. - Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer . Setup: https://y2.dev/docs/api/create-key. - x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402. - OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json. Collected public records only. Check source status for coverage and freshness.