CVE-2023-40474: High Heap Overflow in GStreamer MXF Parser

CVE-2023-40474 is a high severity (CVSS 8.8) integer overflow in GStreamer's MXF file parsing, leading to a heap overwrite when a file has uncompressed video. GStreamer says gst-plugins-bad before 1.22.6 is affected and that 1.22.6 fixes it.

What's affected

The GStreamer advisory SA-2023-0006 says the affected versions are gst-plugins-bad before 1.22.6. The NVD record lists GStreamer without version numbers, so the advisory is the source for the range. The record scores the flaw 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

The weakness is CWE-190 (integer overflow). The advisory title is: integer overflow leading to heap overwrite in MXF file handling with uncompressed video (GStreamer-SA-2023-0006, ZDI-CAN-21660).

The advisory's own impact statement is more careful than the score: it says a malicious third party could trigger a crash, and possibly achieve code execution through memory manipulation. The record is not marked as a CISA Known Exploited Vulnerability, and the advisory does not say it is exploited. The fix is in the gst-plugins-bad 1.22.6 releases. People on older branches are told to apply the patch and recompile.

How to check if you're exposed

GStreamer is usually a system library, so start with the package manager. On Debian or Ubuntu style systems:

dpkg -l | grep -i gstreamer1.0-plugins-bad
gst-inspect-1.0 --version
pkg-config --modversion gstreamer-plugins-bad-1.0

On other systems use your package manager's query, or check the version your application bundles. A version below 1.22.6 is affected according to the upstream advisory. Distributions often backport fixes without changing the upstream version number, so a lower number does not prove exposure. The record links a Debian LTS announcement for that reason, and your distribution's security tracker is the right place to confirm.

Also check container images. Media libraries are often pulled in as dependencies of something else, and they travel inside base images. You can also paste a manifest into the free in-browser dependency scan at gold.safeguard.sh/scan to see which known CVEs touch your packages.

What to do now

1. Inventory hosts, containers and applications that include gst-plugins-bad, directly or through a media framework.
2. Update to 1.22.6 or later, or to your distribution's fixed package, and restart the services that use it.
3. For builds on older branches, apply the upstream patch linked in the advisory and rebuild.
4. Where media files come from users or the internet, process them in a sandboxed worker with no secrets and no unneeded network access.
5. Rescan images and manifests after the update to confirm the finding is closed.

Why it matters

The description in the record says the flaw is in the parsing of MXF video files, where a lack of validation of user supplied data causes an integer overflow before a buffer is allocated. The buffer ends up smaller than the data written into it, and the write spills past the end. That is a classic sequence: arithmetic that wraps around, then an allocation that trusts the wrong number.

The record notes that attack vectors vary with how the library is used. The library does the parsing, so the real exposure depends on where your application feeds it files or streams from outside. A thumbnailer, an upload pipeline or a media player on a desktop each look different on that question.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GStreamer security advisory SA-2023-0006

Last reviewed: 19 October 2026.