CVE-2024-47538

Summary

CVE-2024-47538 is a stack-buffer overflow vulnerability affecting the `vorbis_handle_identification_packet` function in the GStreamer library (gstvorbisdec.c). This issue occurs when the number of channels in a media file exceeds the size of a stack-allocated buffer used to store channel positions. The result is an out-of-bounds write, allowing an attacker to overwrite the EIP address and potentially gain control of the execution flow. Additionally, the `GstAudioInfo` structure can be overwritten, leading to unintended behavior. This vulnerability has been addressed in version 1.24.10 of GStreamer.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.