CVE-2024-47615

A flaw was found in the GStreamer library. An out-of-bounds write in the Ogg demuxer can cause crashes for certain input files. This vulnerability allows a malicious third party to trigger out-of-bounds writes that can result in the application's crash or possibly allow code execution through heap manipulation.

This vulnerability should be classified as important severity rather than moderate due to its potential impact on memory integrity and application stability. The out-of-bounds write (OOB-Write) in the gst_parse_vorbis_setup_packet function overwrites up to 380 bytes of memory beyond the boundaries of the vorbis_mode_sizes array, directly corrupting adjacent memory structures. Such corruption could lead to uncontrolled behavior, including crashes, denial of service, or even arbitrary code execution if an attacker crafts malicious input to exploit the overwritten memory. The absence of proper bounds validation makes the vulnerability exploitable with untrusted input, elevating the risk in scenarios where GStreamer is used to process external or user-supplied media files.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.