CVE-2024-47599— GHSL-2024-247: GStreamer Insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences
Quick assessment
Affected
gstreamer gstreamer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GStreamer是GStreamer开源的一套用于处理流媒体的框架。 GStreamer存在代码问题漏洞，该漏洞源于在gstjpegdec.c中的gst_jpeg_dec_negotiate函数中发现空指针取消引用漏洞。
Possible ATT&CK Techniques 1 AI
T1499.002 · Service Exhaustion Flood
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-47599
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GHSL-2024-247: GStreamer Insufficient error handling in JPEG decoder that can lead to NULL-pointer dereferences
Source: CVE Program / CVE List V5
Vulnerability Description
GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_jpeg_dec_negotiate function in gstjpegdec.c. This function does not check for a NULL return value from gst_video_decoder_set_output_state. When this happens, dereferences of the outstate pointer will lead to a null pointer dereference. This vulnerability can result in a Denial of Service (DoS) by triggering a segmentation fault (SEGV). This vulnerability is fixed in 1.24.10.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Vulnerability Title
GStreamer 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
GStreamer是GStreamer开源的一套用于处理流媒体的框架。 GStreamer存在代码问题漏洞，该漏洞源于在gstjpegdec.c中的gst_jpeg_dec_negotiate函数中发现空指针取消引用漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-47599
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-47599
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-47599 (2)
-
GStreamer Security Advisory x_refsource_MISC
Same Patch Batch · gstreamer · 2024-12-11 · 29 CVEs total
| CVE-2024-47606 | GHSL-2024-166: GStreamer Integer overflows in MP4/MOV demuxer and memory allocator that ca | |
| CVE-2024-47776 | GHSL-2024-260: GStreamer has a OOB-read in gst_wavparse_cue_chunk | |
| CVE-2024-47601 | GHSL-2024-249: GStreamer has a NULL-pointer dereference in Matroska/WebM demuxer | |
| CVE-2024-47537 | GHSL-2024-094: GStreamer has an OOB-write in isomp4/qtdemux.c | |
| CVE-2024-47600 | GHSL-2024-248: GStreamer has an OOB-read in format_channel_mask | |
| CVE-2024-47538 | GHSL-2024-115: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packe | |
| CVE-2024-47615 | GHSL-2024-117: GStreamer has an out-of-bounds write in Ogg demuxer | |
| CVE-2024-47834 | GHSL-2024-280: Gstreamer Use-After-Free read in Matroska CodecPrivate | |
| CVE-2024-47541 | GHSL-2024-228: GStreamer has an out-of-bounds write in SSA subtitle parser | |
| CVE-2024-47539 | GHSL-2024-195: GStreamer has an OOB-write in convert_to_s334_1a | |
| CVE-2024-47607 | GHSL-2024-116: Stack-buffer overflow in gst_opus_dec_parse_header | |
| CVE-2024-47775 | GHSL-2024-261: GStreamer has an OOB-read in parse_ds64 | |
| CVE-2024-47596 | GHSL-2024-244: GStreamer has an OOB-read in FOURCC_SMI_ parsing | |
| CVE-2024-47835 | GHSL-2024-263: Gstreamer NULL-pointer dereference in LRC subtitle parser | |
| CVE-2024-47546 | GHSL-2024-243: GStreamer has an integer underflow in extract_cc_from_data leading to OOB-r | |
| CVE-2024-47540 | GHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxer | |
| CVE-2024-47597 | GHSL-2024-245: GStreamer has an OOB-read in qtdemux_parse_samples | |
| CVE-2024-47778 | GHSL-2024-258: GStreamer has an OOB-read in gst_wavparse_adtl_chunk | |
| CVE-2024-47598 | GHSL-2024-246: GStreamer has an OOB-read in qtdemux_merge_sample_table | |
| CVE-2024-47603 | GHSL-2024-251: GStreamer NULL-pointer dereference in Matroska/WebM demuxer |
Showing top 20 of 29 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: gstreamer
-
CVE-2026-18299
GStreamer rtpsbcdepay Use-After-Free Remote Code Execution V -
CVE-2026-18298
GStreamer PNG File Parsing Heap-based Buffer Overflow Remote -
CVE-2026-18297
GStreamer OGG File Parsing Stack-based Buffer Overflow Remot -
CVE-2026-18296
GStreamer MRF File Parsing Heap-based Buffer Overflow Remote -
CVE-2026-18295
GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code E
Same vendor: gstreamer
-
CVE-2026-18299
GStreamer rtpsbcdepay Use-After-Free Remote Code Execution V -
CVE-2026-18298
GStreamer PNG File Parsing Heap-based Buffer Overflow Remote -
CVE-2026-18297
GStreamer OGG File Parsing Stack-based Buffer Overflow Remot -
CVE-2026-18296
GStreamer MRF File Parsing Heap-based Buffer Overflow Remote -
CVE-2026-18295
GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code E
Same weakness: CWE-476
-
CVE-2026-82357
RT-Labs AB C-Open CANopen NULL pointer dereference -
CVE-2026-9032
Unauthenticated Onboarding Connect NULL Pointer Dereference -
CVE-2026-63686
Apache HTTP Server: mod_xml2enc crash on charset conversion -
CVE-2026-46729
Apache HTTP Server: mod_heartmonitor denial of service -
CVE-2026-47531
NVIDIA驱动内核空指针解引用致拒绝服务漏洞
V. Comments for CVE-2024-47599
No comments yet