CVE-2024-47607

A flaw was found in the GStreamer library. A stack buffer overflow in the Opus decoder can cause crashes for certain input files, potentially allowing a malicious third party to trigger an application crash.

This vulnerability in gst_opus_dec_parse_header is of important severity because it allows an attacker to trigger a stack-based buffer overflow by exceeding the pos array's bounds with unvalidated n_channels input. Since the pos array is stack-allocated, writing beyond its boundaries can overwrite critical memory regions, including the return address or control data, potentially leading to arbitrary code execution or complete compromise of the affected system. Moreover, the written value, GST_AUDIO_CHANNEL_POSITION_NONE, being predictable, may aid attackers in crafting reliable exploits.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.