CVE-2023-50186

Deeper analysis

GStreamer contains a stack-based buffer overflow vulnerability in its AV1 video parsing code, tracked as CVE-2023-50186. The flaw stems from insufficient validation of the length of attacker-supplied metadata before it is copied into a fixed-size stack buffer during processing of AV1-encoded video files. Successful exploitation grants remote code execution in the context of the affected GStreamer process. The issue was originally reported as ZDI-CAN-22300 and carries a CVSS 3.1 score of 8.8.

Remote attackers can trigger the vulnerability by supplying a malicious AV1 video file to any application that uses the vulnerable GStreamer library for media handling. No authentication is required, and the attack can be delivered through typical media ingestion paths such as file playback or network streams, depending on the integrating application. Exploitation results in arbitrary code execution with the privileges of the GStreamer process.

The GStreamer project has published security advisory SA-2023-0011, which includes patches for the affected AV1 parser. The Zero Day Initiative advisory ZDI-24-368 provides additional technical detail and confirms vendor remediation. The associated EPSS score has remained flat at 0.0918 with no material increase since disclosure.