CVE-2023-37327: High Integer Overflow in GStreamer FLAC Parsing

CVE-2023-37327 is a high severity (CVSS 8.8) integer overflow in the gst-plugins-good package of GStreamer, triggered by parsing a malformed FLAC audio file. The GStreamer advisory says releases 1.22.4 and 1.20.7 fix it. Update the plugin set, or patch and rebuild if you run an older branch.

What's affected

GStreamer security advisory 0001 (GStreamer-SA-2023-0001) lists the affected component as gst-plugins-good, versions 1.x before 1.22.4 on the current branch, 1.x before 1.20.7 on the older stable branch, and 0.10.x. The weakness is recorded as CWE-190 (integer overflow or wraparound). ZDI tracks it as ZDI-23-903.

The advisory states the impact plainly: a malicious third party can trigger a crash in the application, and possibly achieve code execution through heap manipulation. The record adds that user interaction is needed, and that the way an attacker delivers a file depends on the application that embeds the library.

The sources do not fully agree here. The NVD record scores it 8.8 (high) and calls it an integer overflow before a buffer is allocated. ZDI scores the same flaw 7.6, with a lower confidentiality and integrity impact. The GStreamer advisory describes an integer overflow leading to a heap overwrite in FLAC image tag handling, and its detail line says heap-based buffer overflow in the FLAC parser. All three put the fix in the same releases, so the numbers do not change what you do.

How to check if you're exposed

GStreamer is a library, so the question is which version your applications load.

1. Run gst-inspect-1.0 --version on a Linux or macOS host to see the installed core version. Plugins ship in matching releases, so compare it with 1.22.4 and 1.20.7.
2. Check your distribution package manager for the plugin package, for example dpkg -l | grep gstreamer on Debian based systems or rpm -qa | grep gstreamer on RPM based ones. Distributions often backport fixes without changing the upstream version, so read the distribution security notice too.
3. For containers and bundled apps, look for GStreamer libraries inside the image or the application directory. The vendor of a bundled app may have shipped its own copy.
4. Scan your lockfiles and images with the free dependency scan at gold.safeguard.sh/scan if GStreamer arrives as a transitive dependency.

What to do now

1. Upgrade gst-plugins-good to 1.22.4 or later on the current branch, or 1.20.7 or later on the older stable branch, using your distribution or the upstream release.
2. If you build GStreamer yourself on an older branch, apply the patch linked from the advisory and recompile.
3. Rebuild container images that bundle GStreamer so the fixed library is in the image, not only on the host.
4. Until you have updated, avoid opening FLAC audio files from untrusted sources in applications that use GStreamer.
5. Re-run your scan after the update to confirm the old version is gone.

Why it matters

Media parsers handle files from the outside world, which makes them a steady source of memory safety bugs. Here the parser trusts data from the file when it works out how much memory to reserve or copy. The record describes missing validation of the length of user-supplied data, so the write runs past the end of an allocated buffer. A crash is the likely outcome, and the advisory does not rule out code execution.

The record does not mark this CVE as known exploited, and the advisories I checked do not report exploitation. Still, GStreamer sits underneath desktop players, thumbnailers and embedded devices, so the real exposure depends on what feeds it files. Reachability analysis helps here, because a library present in an image is not the same as a vulnerable code path your product calls. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan against a manifest or lockfile, and browse the Gold directory for related entries.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GStreamer security advisory 2023-0001
• Zero Day Initiative advisory ZDI-23-903

Last reviewed: 19 October 2026.