CVE-2023-38104 is a high severity (CVSS 8.8) integer overflow in the GStreamer RealMedia demuxer, which parses MDPR chunks. A crafted file can lead to code execution in the process that opens it. GStreamer has published a patch, so update the library through your distribution or rebuild with the fix.
What's affected
The NVD record lists GStreamer 1.22.3 as the affected configuration. The flaw is in the parsing of MDPR chunks in RealMedia files. The record is dated 2024-05-03 and carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
The Zero Day Initiative advisory ZDI-23-1008 gives the same 8.8 score and says GStreamer has issued an update. It links a source patch named "rmdemux: Check for integer overflow when calculating..." as the fix. I could not load the GStreamer security advisory itself, so I cannot confirm a first fixed release number here. Check the GStreamer security advisories page and your distribution's tracker for the exact fixed version of the package you run.
ZDI notes that interaction with the library is required, and that attack vectors may vary depending on the implementation. In practice that means any application that hands untrusted media files to GStreamer is in scope, such as media players, thumbnailers and file indexers.
Weakness class: CWE-190.
How to check if you're exposed
Find which GStreamer version each system uses, then compare it with your distribution's security tracker.
gst-inspect-1.0 --version
dpkg -l | grep -i gstreamer # Debian and Ubuntu
rpm -qa | grep -i gstreamer # Fedora, RHEL and similar
Also look for software that bundles its own copy of GStreamer, such as desktop apps shipped as containers or AppImages. Those do not update with the system package, so check the vendor's release notes for each one.
What to do now
- List every host and container image that includes GStreamer, including desktop thumbnailers and media tools.
- Install the patched package from your distribution, or rebuild from upstream with the rmdemux fix applied.
- Restart the applications that load GStreamer so they pick up the new library.
- Until patched, avoid opening RealMedia files from untrusted sources and disable the RealMedia demuxer plugin where you do not need it.
- Scan bundled copies in container images and application directories, since system updates do not reach them.
Why it matters
The bug is a classic length calculation problem. While reading an MDPR chunk the parser multiplies or adds values taken from the file, and the result can wrap around before a buffer is allocated. The buffer ends up smaller than the data written into it. Because the file author controls the numbers, they control the mismatch.
Media libraries are a frequent target for this class because they parse many complicated, old formats, often automatically. A file manager that generates a thumbnail can be enough to run the parser. ZDI describes the outcome as code execution in the context of the current process, so the impact depends on what runs GStreamer. The CVE is not on the CISA Known Exploited Vulnerabilities list, and the sources I read do not report exploitation.
An integer overflow happens when arithmetic on a size or count produces a number too large for its type, so it wraps around to a small value. If that wrapped value is then used to size a memory allocation, the program reserves too little space and later writes more data than fits. The safe pattern is to check the arithmetic before it is used, and to reject any file or message whose declared sizes do not add up.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the libraries a project declares, and reachability analysis helps show whether a vulnerable library is actually called. Copies bundled inside other products need your own inventory as well.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to patch if nobody opens RealMedia files?
Patch anyway. Automatic thumbnailing and indexing can parse files without a person opening them, and the update is routine through your package manager.
Where do I find the fixed version?
ZDI points to the upstream patch. For a version number, use the GStreamer security advisories and your distribution's tracker, because I could not confirm one from the sources I fetched.
Sources
Last reviewed: 19 October 2026.
