CVE-2024-47544 GHSL-2024-238: GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handling

What is CVE-2024-47544?

CVE-2024-47544 is a medium-severity vulnerability in Gstreamer Gstreamer, published on 11 Dec 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

GStreamer is a library for constructing graphs of media-handling components. The function qtdemux_parse_sbgp in qtdemux.c is affected by a null dereference vulnerability. This vulnerability is fixed in 1.24.10.

Weakness: CWE-476

Which versions are affected by CVE-2024-47544?

3 open source packages ship an affected version, including java, java-min and jre. It affects 1 product.

Products include Gstreamer Gstreamer.

How do I fix CVE-2024-47544?

Upgrade java to a fixed version for your release line: 1.8.0 or 8.0.451.

Is CVE-2024-47544 being exploited?

There is no known exploitation of CVE-2024-47544 in the wild and no public exploit code.

Other vulnerabilities in Gstreamer Gstreamer

• CVE-2026-3083 GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability High 8.8
• CVE-2026-3085 GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability High 8.8
• CVE-2023-37328 GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability High 8.8
• CVE-2023-37329 GStreamer SRT File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability High 8.8
• CVE-2023-38103 GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability High 8.8

All Gstreamer Gstreamer vulnerabilities

Sources

• CVE record
• NVD
• OSV
• How this page is made

Also known as AZL-62411, BIT-java-2024-47544, BIT-java-min-2024-47544, BIT-jre-2024-47544, CLSA-2025-1749506165, DEBIAN-CVE-2024-47544 and 2 more.