CVE-2024-47601 GHSL-2024-249: GStreamer has a NULL-pointer dereference in Matroska/WebM demuxer

What is CVE-2024-47601?

CVE-2024-47601 is a medium-severity vulnerability in Gstreamer Gstreamer, published on 11 Dec 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_parse_blockgroup_or_simpleblock function within matroska-demux.c. This function does not properly check the validity of the GstBuffer *sub pointer before performing dereferences. As a result, null pointer dereferences may occur. This vulnerability is fixed in 1.24.10.

Weakness: CWE-476

Which versions are affected by CVE-2024-47601?

It affects 1 product.

Products include Gstreamer Gstreamer.

How do I fix CVE-2024-47601?

Upgrade to a fixed version.

Is CVE-2024-47601 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47601 exists.

Other vulnerabilities in Gstreamer Gstreamer

• CVE-2026-3083 GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability High 8.8
• CVE-2026-3085 GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability High 8.8
• CVE-2023-37328 GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability High 8.8
• CVE-2023-37329 GStreamer SRT File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability High 8.8
• CVE-2023-38103 GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability High 8.8

All Gstreamer Gstreamer vulnerabilities

Sources

• CVE record
• NVD
• OSV
• How this page is made

Also known as AZL-62348, DEBIAN-CVE-2024-47601, UBUNTU-CVE-2024-47601.