GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in extract_cc_from_data function within qtdemux.c. In the FOURCC_c708 case, the subtraction atom_length - 8 may result in an underflow if atom_length is less than 8. When that subtraction underflows, *cclen ends up being a large number, and then cclen is passed to g_memdup2 leading to an out-of-bounds (OOB) read. This vulnerability is fixed in 1.24.10.
| Version | Score | Severity | Vector String |
|---|---|---|---|
| 4.0 | 6.9 | Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| Product | Vendor | Version |
|---|---|---|
| gstreamer | gstreamer | < 9.3.1 |
| gstreamer | gstreamer | < 00e81f191bc00cb6faabf468960e96ebf0404a6c |