CVE-2023-38103 is a high severity (CVSS 8.8) integer overflow in how GStreamer parses RealMedia files, specifically MDPR chunks. A crafted file can lead to code execution in the process that opens it. GStreamer has released a patch, so update your GStreamer packages and check your distribution advisory for the version.
What's affected
The record names GStreamer 1.22.3 as the affected version and scores the flaw 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. That means a network delivered file, no privileges, a user or application that has to open it, and high impact on confidentiality, integrity and availability. The Zero Day Initiative advisory ZDI-23-1007, published on 27 July 2023, gives the same 8.8 score.
ZDI says the flaw is in the parsing of MDPR chunks, where missing validation of user supplied data allows an integer overflow before a buffer is allocated. An attacker can run code in the context of the current process. ZDI notes that attack vectors vary by how an application uses the library. The weakness is CWE-190 (integer overflow or wraparound).
ZDI says GStreamer has issued an update and links a patch titled "rmdemux: Check for integer overflow when calculating..." in the GStreamer repository. Neither the record nor the ZDI page names the fixed release number, so confirm it in the GStreamer security advisories or your distribution's notes. The record does not flag CISA KEV.
How to check if you're exposed
Find which GStreamer version your system and your applications use:
gst-inspect-1.0 --version
gst-inspect-1.0 rmdemux
dpkg -l | grep -i gstreamer
The second command shows whether the RealMedia demuxer plugin is present. On RPM based systems use rpm -qa with a gstreamer filter. Version 1.22.3 is the one named in the record, and distributions often backport fixes without changing the upstream version number, so check the vendor advisory and not only the number.
GStreamer is also bundled inside other software, such as media players, desktop environments and some applications that ship their own copy. Search container images and application folders as well as the system package list.
What to do now
- Inventory every host, container image and application that includes GStreamer.
- Apply your distribution's update for GStreamer, or rebuild with an upstream release that includes the rmdemux fix, and confirm the version against the advisory.
- If you cannot update yet, remove or disable the RealMedia demuxer where you do not need it, since the flaw is in that parser.
- Avoid letting services that use GStreamer process media from untrusted sources, such as thumbnailers on upload folders, until patched.
- Rescan images after the update.
Why it matters
An integer overflow in a size calculation is a classic route to memory corruption. If the code multiplies or adds values taken from a file, the result can wrap around to a small number. The program allocates a small buffer, then copies in far more data than fits. Memory beyond the buffer is overwritten, and a careful attacker can steer the program.
Media libraries are a common target because they parse many complicated formats, often automatically. A thumbnail generator or indexer can open a file with no one clicking on it. The RealMedia format is old and rarely used now, which means the parser gets little attention but is still compiled in by default on many systems. Removing unused demuxers is a cheap way to shrink the attack surface.
Try it yourself
A library flaw only matters if your code calls the vulnerable path. This demo shows how reachability analysis separates the GStreamer installs that matter from those that do not.
Click through it at your own pace, or open it full screen.
Quick check
Does this need someone to open a file?
Yes. ZDI says interaction with the library is required, and that vectors vary by how the application uses it. An automatic indexer or thumbnailer can count as that interaction.
Which version fixes it?
Neither the record nor the ZDI advisory states the release number. Use the GStreamer advisories and your distribution notes.
Sources
- ZDI advisory ZDI-23-1007
- GStreamer patch linked from the record (we did not read the patch itself)
- CVE-2023-38103 on Gold
Last reviewed: 19 October 2026.
