CVE-2024-47774 GHSL-2024-262: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk
An integer overflow in GStreamer's AVI subtitle parser allows out-of-bounds reads, potentially causing crashes or leaking memory contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47774?
CVE-2024-47774 is a medium-severity vulnerability in Gstreamer Gstreamer, published on 11 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_avi_subtitle_parse_gab2_chunk function within gstavisubtitle.c. The function reads the name_length value directly from the input file without checking it properly. Then, the a condition, does not properly handle cases where name_length is greater than 0xFFFFFFFF - 17, causing an integer overflow. In such scenario, the function attempts to access memory beyond the buffer leading to an OOB-read. This vulnerability is fixed in 1.24.10.
Weakness: CWE-125
Which versions are affected by CVE-2024-47774?
It affects 1 product.
Products include Gstreamer Gstreamer.
How do I fix CVE-2024-47774?
Upgrade to a fixed version.
Is CVE-2024-47774 being exploited?
There is no known exploitation of CVE-2024-47774 in the wild and no public exploit code.
Other vulnerabilities in Gstreamer Gstreamer
- CVE-2026-3083 GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2026-3085 GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2023-37328 GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2023-37329 GStreamer SRT File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2023-38103 GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability
Sources
Also known as AZL-62339, CLSA-2025-1748001706, DEBIAN-CVE-2024-47774, UBUNTU-CVE-2024-47774.