CVE-2023-40474

Deeper analysis

GStreamer contains an integer overflow vulnerability in its MXF file parser that can lead to remote code execution. The flaw, tracked as CVE-2023-40474 and originally ZDI-CAN-21660, stems from insufficient validation of user-supplied data during MXF video file processing, allowing an overflow to occur before a buffer is allocated. Affected installations include multiple versions of the GStreamer multimedia framework, which is commonly used by media applications and libraries that handle MXF content.

Remote attackers can exploit the issue by supplying a malicious MXF file to any application that uses the vulnerable GStreamer library. Successful exploitation grants arbitrary code execution in the context of the current process. The attack requires the target to process attacker-controlled media but does not need authentication, and the CVSS 8.8 score reflects network-accessible vectors with high impact on confidentiality, integrity, and availability.

Official advisories published by the GStreamer project and downstream vendors such as Debian address the flaw and reference corresponding patches. Security practitioners should consult the GStreamer security advisory and vendor updates for fixed versions and backports. The associated EPSS score has remained low, with a current value of 0.0617 and a peak of 0.0705.