CVE-2023-40475

Deeper analysis

GStreamer is affected by an integer overflow vulnerability, tracked as CVE-2023-40475 and originally reported as ZDI-CAN-21661, that permits remote code execution during the parsing of MXF video files. The flaw stems from insufficient validation of user-supplied data, which can produce an integer overflow prior to buffer allocation; successful exploitation grants arbitrary code execution in the context of the GStreamer process. The issue carries a CVSS 3.1 base score of 8.8 and is classified under CWE-190.

Remote attackers can trigger the vulnerability by supplying a crafted MXF file to any application that uses the affected GStreamer library. No authentication is required and attack complexity is low, although user interaction is needed to open or process the malicious file; the resulting code execution occurs within the privileges of the hosting process.

Official advisories from the GStreamer project and downstream distributions such as Debian provide patched versions that correct the integer handling during MXF parsing; practitioners should apply the updates referenced in GStreamer security advisory SA-2023-0007 and the corresponding Debian LTS announcements.

EPSS for the CVE reached a peak of 0.0744 after disclosure before receding to its current value of 0.0428, indicating a measurable but temporary increase in observed exploitation interest.