CVE-2024-47607
Critical
Description
GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_parse_header function within `gstopusdec.c'. The pos array is a stack-allocated buffer of size 64. If n_channels exceeds 64, the for loop will write beyond the boundaries of the pos array. The value written will always be GST_AUDIO_CHANNEL_POSITION_NONE. This bug allows to overwrite the EIP address allocated in the stack. This vulnerability is fixed in 1.24.10.
SeverityCritical
CVSS9.8
Exploit probability—
ProductGstreamer
PublishedDec 12, 2024
First seenDec 12, 2024
Weakness typeCWE-121CWE-121
How to fix
Update
- gstreamer gstreamer1.24.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gstreamer gstreamer | v < 1.24.10 | 1.24.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.