CVE-2023-37328: High Heap Overflow in GStreamer PGS Parsing

CVE-2023-37328 is a high severity (CVSS 8.8) heap overflow in the gst-plugins-bad package of GStreamer, triggered by parsing a malformed PGS subtitle file. The GStreamer advisory says releases 1.22.4 and 1.20.7 fix it. Update the plugin set, or patch and rebuild if you run an older branch.

What's affected

GStreamer security advisory 0003 (GStreamer-SA-2023-0003) lists the affected component as gst-plugins-bad, versions 1.x before 1.22.4 on the current branch, 1.x before 1.20.7 on the older stable branch, and 0.10.x. The weakness is recorded as CWE-122 (heap-based buffer overflow). ZDI tracks it as ZDI-23-901.

The advisory states the impact plainly: a malicious third party can trigger a crash in the application, and possibly achieve code execution through heap manipulation. The record adds that user interaction is needed, and that the way an attacker delivers a file depends on the application that embeds the library.

How to check if you're exposed

GStreamer is a library, so the question is which version your applications load.

1. Run gst-inspect-1.0 --version on a Linux or macOS host to see the installed core version. Plugins ship in matching releases, so compare it with 1.22.4 and 1.20.7.
2. Check your distribution package manager for the plugin package, for example dpkg -l | grep gstreamer on Debian based systems or rpm -qa | grep gstreamer on RPM based ones. Distributions often backport fixes without changing the upstream version, so read the distribution security notice too.
3. For containers and bundled apps, look for GStreamer libraries inside the image or the application directory. The vendor of a bundled app may have shipped its own copy.
4. Scan your lockfiles and images with the free dependency scan at gold.safeguard.sh/scan if GStreamer arrives as a transitive dependency.

What to do now

1. Upgrade gst-plugins-bad to 1.22.4 or later on the current branch, or 1.20.7 or later on the older stable branch, using your distribution or the upstream release.
2. If you build GStreamer yourself on an older branch, apply the patch linked from the advisory and recompile.
3. Rebuild container images that bundle GStreamer so the fixed library is in the image, not only on the host.
4. Until you have updated, avoid opening PGS subtitle files from untrusted sources in applications that use GStreamer.
5. Re-run your scan after the update to confirm the old version is gone.

Why it matters

Media parsers handle files from the outside world, which makes them a steady source of memory safety bugs. Here the parser trusts data from the file when it works out how much memory to reserve or copy. The record describes missing validation of the length of user-supplied data, so the write runs past the end of an allocated buffer. A crash is the likely outcome, and the advisory does not rule out code execution.

The record does not mark this CVE as known exploited, and the advisories I checked do not report exploitation. Still, GStreamer sits underneath desktop players, thumbnailers and embedded devices, so the real exposure depends on what feeds it files. Reachability analysis helps here, because a library present in an image is not the same as a vulnerable code path your product calls. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan against a manifest or lockfile, and browse the Gold directory for related entries.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GStreamer security advisory 2023-0003
• Zero Day Initiative advisory ZDI-23-901

Last reviewed: 19 October 2026.