CVE-2024-47599 - CVE House

Back to Database

Status published Medium CVE-2024-47599

GHSL-2024-247: GStreamer Insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences

6.8 CVSS

Vulnerability Description

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_jpeg_dec_negotiate function in gstjpegdec.c. This function does not check for a NULL return value from gst_video_decoder_set_output_state. When this happens, dereferences of the outstate pointer will lead to a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-47599

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from gstreamer

View All →

GHSL-2024-263: Gstreamer NULL-pointer dereference in LRC subtitle parser

GHSL-2024-280: Gstreamer Use-After-Free read in Matroska CodecPrivate

GHSL-2024-258: GStreamer has an OOB-read in gst_wavparse_adtl_chunk

GHSL-2024-259: GStreamer has an OOB-read in gst_wavparse_smpl_chunk

GHSL-2024-260: GStreamer has a OOB-read in gst_wavparse_cue_chunk

Affected Vendor

gstreamer

View all reports →

Affected Software

gstreamer

Vulnerable Versions:

< 1.24.10

Timeline

Official Publish: December 11th, 2024

Last Modified: November 3rd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1499.004 Application or System Exploitation

T1489 Service Stop

T1203 Exploitation for Client Execution

T1190 Exploit Public-Facing Application