CVE-2024-47777
GHSL-2024-259: GStreamer has an OOB-read in gst_wavparse_smpl_chunk
Reported by github_m · Published December 11, 2024
GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_wavparse_smpl_chunk function within gstwavparse.c. This function attempts to read 4 bytes from the data + 12 offset without checking if the size of the data buffer is sufficient. If the buffer is too small, the function reads beyond its bounds. This vulnerability may result in reading 4 bytes out of the boundaries of the data buffer. This vulnerability is fixed in 1.24.10.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| openjdk-26-openj9 | Chainguard | 0.59.0-r1 |
| gstreamer1-plugins-good | Amazon Linux | 1.18.4-6.amzn2.0.7 |
| openjdk-11-openj9 | Chainguard | 0.53.0-r0 |
| gstreamer1-plugins-good-gtk | Amazon Linux | 1.18.4-6.amzn2.0.7 |
| openjdk-25-openj9 | Chainguard | 0.59.0-r1 |
| gst-plugins-good | Alpine | 1.24.10-r0 |
| openjdk-8-openj9 | Chainguard | 0.53.0-r1 |
| openjdk-17-openj9 | Chainguard | 0.53.0-r0 |
| openjdk-21-openj9 | Chainguard | 0.53.0-r0 |
| gstreamer | gstreamer | 1.24.10 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| gstreamer | gstreamer | < 1.24.10 |
| chainguard | openjdk-26-openj9 | 0 |
| amazon:2 | gstreamer1-plugins-good | 0 |
| chainguard | openjdk-11-openj9 | 0 |
| amazon:2 | gstreamer1-plugins-good-gtk | 0 |
| chainguard | openjdk-25-openj9 | 0 |
| alpine | gst-plugins-good | 0 |
| chainguard | openjdk-8-openj9 | 0 |
| chainguard | openjdk-17-openj9 | 0 |
| chainguard | openjdk-21-openj9 | 0 |
| gstreamer | gstreamer | 0 |
Timeline
- Dec 3, 2024 CVE Published
- Dec 12, 2024 EPSS Score (30 in total, the first dated here)
- May 29, 2025 Coalition ESS Score (8 in total, the first dated here)
- Jan 3, 2026 Security Advisory (41 in total, the first dated here)
- Oct 15, 2026 Distribution Patch (25 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-47777
vulnetix vdb fixes CVE-2024-47777Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-47777/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://securitylab.github.com/advisories/GHSL-2024-259_Gstreamer/ x_refsource_CONFIRM
- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042.patch x_refsource_MISC
- https://gstreamer.freedesktop.org/security/sa-2024-0027.html x_refsource_MISC
- https://lists.debian.org/debian-lts-announce/2025/02/msg00035.html advisory