CVE-2024-47602

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Dec 12, 2024
Updated: Dec 18, 2024
CWE ID 125
CWE ID 476

Summary

CVE-2024-47602 is a null pointer dereference vulnerability affecting the GStreamer library. The issue lies in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. This function fails to verify the validity of the stream->codec_priv pointer, which can result in a null pointer being passed to GST_READ_UINT16_LE. If this occurs, a crash of the application ensues. This vulnerability has been remedied in version 1.24.10.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Gstreamer Project Gstreamer

Affected Vendors

  • Gstreamer Project

Advisories, Assessments, and Mitigations