CVE-2024-47774 - CVE House

Back to Database

Status published Medium CVE-2024-47774

GHSL-2024-262: GStreamer has an OOB-read in gst_avi_subtitle_parse_gab2_chunk

5.1 CVSS

Vulnerability Description

GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_avi_subtitle_parse_gab2_chunk function within gstavisubtitle.c. The function reads the name_length value directly from the input file without checking it properly. Then, the a condition, does not properly handle cases where name_length is greater than 0xFFFFFFFF - 17, causing an integer overflow. In such scenario, the function attempts to access memory beyond the buffer leading to an OOB-read. This vulnerability is fixed in 1.24.10.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-47774

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from gstreamer

View All →

GHSL-2024-263: Gstreamer NULL-pointer dereference in LRC subtitle parser

GHSL-2024-280: Gstreamer Use-After-Free read in Matroska CodecPrivate

GHSL-2024-258: GStreamer has an OOB-read in gst_wavparse_adtl_chunk

GHSL-2024-259: GStreamer has an OOB-read in gst_wavparse_smpl_chunk

GHSL-2024-260: GStreamer has a OOB-read in gst_wavparse_cue_chunk

Affected Vendor

gstreamer

View all reports →

Affected Software

gstreamer

Vulnerable Versions:

< 1.24.10

Timeline

Official Publish: December 11th, 2024

Last Modified: November 3rd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1213 Data from Information Repositories

T1003 OS Credential Dumping

Credential Access

T1552 Unsecured Credentials

Credential Access