CVE-2024-47606

A flaw was found in the MP4/MOV demuxer and memory allocator in the GStreamer library. Processing a specially crafted input file can cause an integer overflow in the qtdemux_parse_theora_extension function. This issue leads to a small amount of memory being allocated to store a large input size, resulting in an out-of-bounds write.

To exploit this flaw, an attacker needs to trick a user into opening or processing a specially crafted .mov file. However, this issue still has an Important severity as it allows an attacker to trigger an out-of-bounds write to memory allocated in the heap, overwriting critical memory regions, potentially resulting in unexpected behavior, including arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not process untrusted files with the MP4/MOV demuxer and monitor application crashes as this may indicate exploitation attempts.