CVE-2023-40476

Deeper analysis

GStreamer contains a stack-based buffer overflow vulnerability in its H265 video parser that permits remote code execution. The flaw, tracked as CVE-2023-40476 and originally ZDI-CAN-21768, arises from insufficient validation of the length of attacker-supplied data before it is copied into a fixed-size stack buffer during parsing of H265 encoded files. Affected installations include multiple versions of the GStreamer multimedia framework, which is widely used by applications that process untrusted media.

An unauthenticated remote attacker can trigger the issue by supplying a malicious H265 file or stream to any application that uses the vulnerable GStreamer library. Successful exploitation grants arbitrary code execution in the context of the process that invokes the parser, with a CVSS 3.1 score of 8.8 reflecting network attack vector, low complexity, and no required privileges beyond user interaction with the media.

Public advisories published by the GStreamer project and Zero Day Initiative, along with downstream notices such as the Debian LTS announcement, direct users to updated packages that contain the fix for the parsing routine.

EPSS for the vulnerability rose from lower values to a peak of 0.1060 before receding to its current score of 0.0622, indicating measurable post-disclosure exploitation interest.