CVE-2023-38103

Deeper analysis

GStreamer is affected by an integer overflow vulnerability during RealMedia file parsing that can result in remote code execution. The flaw, assigned CWE-190, resides in the rmdemux module's handling of MDPR chunks where insufficient validation of attacker-controlled values permits an overflow before a buffer is allocated. The issue was reported as ZDI-CAN-21443 and carries a CVSS 3.1 score of 8.8.

Remote attackers can trigger the vulnerability by delivering a crafted RealMedia file to any application that uses the affected GStreamer library. Successful exploitation allows arbitrary code execution in the context of the consuming process; the attack requires user interaction but needs no prior authentication and can be performed over the network.

Publicly referenced patches from the GStreamer project add explicit integer-overflow checks when calculating MDPR chunk sizes, and the Zero Day Initiative advisory ZDI-23-1007 provides additional technical detail on the flaw. The associated EPSS score has remained flat at 0.0786 with no material increase observed after disclosure.