GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in gst_wavparse_cue_chunk within gstwavparse.c. The vulnerability happens due to a discrepancy between the size of the data buffer and the size value provided to the function. This mismatch causes the comparison if (size < 4 + ncues * 24) to fail in some cases, allowing the subsequent loop to access beyond the bounds of the data buffer. The root cause of this discrepancy stems from a miscalculation when clipping the chunk size based on upstream data size. This vulnerability allows reading beyond the bounds of the data buffer, potentially leading to a crash (denial of service) or the leak of sensitive data. This vulnerability is fixed in 1.24.10.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gstreamer1-plugins-good-gtkUpgrade gstreamer1-plugins-good | Jul 4, 2025 | Dec 12, 2024 |
| Alpine Linux | — | Upgrade gst-plugins-goodUpgrade gstreamer | Aug 8, 2025 | Dec 11, 2024 |
| Amazon Linux Ami 2 | — | Upgrade gstreamer1-plugins-good-gtkUpgrade gstreamer1-plugins-good-debuginfoUpgrade gstreamer1-plugins-good | May 20, 2026 | May 20, 2026 |
| Azul Zulu | — | Apply Azul Zulu JDK 24 installer 24.30.11 (JDK 24.0.1+9, PSU) (short-term support); migrate to JDK 25 (LTS)Upgrade to Azul Zulu JDK 11 installer 11.79.18 (JDK 11.0.26.0.101+2, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 8 installer 8.85.0.22 (JDK 8u451-b02, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 21 installer 21.41.18 (JDK 21.0.6.0.101+2, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 17 installer 17.57.18 (JDK 17.0.14.0.101+2, quarterly CPU) (LTS stream) | Feb 25, 2026 | Dec 11, 2024 |
| Debian | — | Upgrade gst-plugins-good1.0 | Dec 31, 2024 | Dec 12, 2024 |
| Freebsd | — | Upgrade gstreamer1-plugins-good | Dec 10, 2025 | Dec 6, 2024 |
| Gentoo Linux | — | Upgrade media-libs/gst-plugins-base.Upgrade media-libs/gstreamer. | Jun 13, 2025 | Dec 12, 2024 |
| Oracle_linux | — | Upgrade gstreamer1-plugins-goodUpgrade gstreamer1-plugins-good-gtk | May 26, 2025 | Dec 11, 2024 |
| Redhat_linux | — | Upgrade gstreamer1-plugins-good-qt-debuginfoNo solution existsUpgrade gstreamer1-plugins-good-gtk-debuginfoUpgrade gstreamer1-plugins-good-gtkUpgrade gstreamer1-plugins-good-debugsourceUpgrade gstreamer1-plugins-good-debuginfoUpgrade gstreamer1-plugins-good | May 14, 2025 | Dec 12, 2024 |
| Rocky_linux | — | Upgrade gstreamer1-plugins-good-debuginfoUpgrade gstreamer1-plugins-good-gtk-debuginfoUpgrade gstreamer1-plugins-good-debugsourceUpgrade gstreamer1-plugins-good-gtkUpgrade gstreamer1-plugins-good | Oct 6, 2025 | Oct 4, 2025 |
| Ubuntu | — | Upgrade gstreamer1.0-pulseaudioUpgrade gstreamer1.0-gtk3Upgrade gstreamer1.0-plugins-goodUpgrade libgstreamer-plugins-good1.0-0Upgrade gstreamer1.0-qt5Upgrade gstreamer1.0-qt6 | Dec 19, 2024 | Dec 12, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 29, 2025 | Dec 11, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub