CVE-2024-47606

Summary

CVE-2024-47606 is a vulnerability affecting the GStreamer media library. In the function qtdemux_parse_theora_extension within qtdemux.c, an integer underflow causes the size variable to hold a large unintended value when cast to an unsigned integer. During memory allocation, only a fraction of the required bytes are allocated, resulting in a buffer overflow. The overwritten memory may subsequently cause a function pointer hijack in gst_memory_unmap, allowing an attacker to alter the execution flow and potentially gain arbitrary code execution. This vulnerability is resolved in version 1.24.10.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.