CVE-2024-47599 GHSL-2024-247: GStreamer Insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences

What is CVE-2024-47599?

CVE-2024-47599 is a medium-severity vulnerability in Gstreamer Gstreamer, published on 11 Dec 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_jpeg_dec_negotiate function in gstjpegdec.c. This function does not check for a NULL return value from gst_video_decoder_set_output_state. When this happens, dereferences of the outstate pointer will lead to a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10.

Weakness: CWE-476

Which versions are affected by CVE-2024-47599?

It affects 1 product.

Products include Gstreamer Gstreamer.

How do I fix CVE-2024-47599?

Upgrade to a fixed version.

Is CVE-2024-47599 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47599 exists.

Other vulnerabilities in Gstreamer Gstreamer

• CVE-2026-3083 GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability High 8.8
• CVE-2026-3085 GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability High 8.8
• CVE-2023-37328 GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability High 8.8
• CVE-2023-37329 GStreamer SRT File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability High 8.8
• CVE-2023-38103 GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability High 8.8

All Gstreamer Gstreamer vulnerabilities

Sources

• CVE record
• NVD
• OSV
• How this page is made

Also known as AZL-62387, DEBIAN-CVE-2024-47599, UBUNTU-CVE-2024-47599.