CVE-2024-47601

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10

Description A null pointer dereference vulnerability has been discovered in the gst matroska demux parse blockgroup or simpleblock function within matroska-demux.c. This function does not properly check the validity of the *sub pointer of GstBuffer before performing dereferences, which may result in null pointer dereferences. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations For versions prior to 1.24.10, update to version 1.24.10 to resolve the issue. As a temporary workaround, consider disabling the gst matroska demux parse blockgroup or simpleblock function until a patch is available. Restrict access to the matroska-demux.c module to minimize the risk of exploitation. Avoid using the GstBuffer *sub pointer in the affected function until the issue is resolved.