CVE-2024-47538

A flaw was found in the Vorbis decoder in the GStreamer library. Processing a specially crafted input file can cause a stack-based buffer overflow in the Vorbis decoder due to improper input validation, resulting in unexpected behavior or, most likely, an application crash.

To exploit this flaw, an attacker needs to trick a user into opening or processing a specially crafted .ogg file. However, this issue still has an Important severity as it allows an attacker to trigger a stack-based buffer overflow and overwrite critical memory regions, including the return address of control data, potentially resulting in unexpected behavior, including arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not process untrusted files with the Vorbis decoder and monitor application crashes as this may indicate exploitation attempts.