CVE-2016-9447
gstreamer-plugins-bad-free: Memory corruption flaw in NSF decoder
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · November 14, 2016
Updated · July 31, 2026
Description
A memory corruption flaw was found in GStreamer's Nintendo NSF music file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
sudo rm /usr/lib*/gstreamer-0.10/libgstnsf.so
Please note that this mitigation deletes the vulnerable NSF codec file, which removes the functionality to play Nintendo NSF music files.
CVSS / CWE
CVSS 3.0 · 7.5CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 · 6.8AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-125 · Out-of-bounds Read