CVE-2023-40475 is a high severity (CVSS 8.8) integer overflow in GStreamer's MXF file parsing, leading to a heap overwrite when a file carries AES3 audio. GStreamer says gst-plugins-bad before 1.22.6 is affected and 1.22.6 fixes it.
What's affected
The GStreamer advisory SA-2023-0007 says the affected versions are gst-plugins-bad before 1.22.6. The NVD record lists GStreamer without version numbers, so the advisory is the source for the range. The record scores the flaw 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
The weakness is CWE-190 (integer overflow). The advisory title is: integer overflow leading to heap overwrite in MXF file handling with AES3 audio (GStreamer-SA-2023-0007, ZDI-CAN-21661).
The advisory's own impact statement is more careful than the score: it says a malicious third party could trigger a crash, and possibly achieve code execution through memory manipulation. The record is not marked as a CISA Known Exploited Vulnerability, and the advisory does not say it is exploited. The fix is in the gst-plugins-bad 1.22.6 releases. People on older branches are told to apply the patch and recompile.
How to check if you're exposed
GStreamer is usually a system library, so start with the package manager. On Debian or Ubuntu style systems:
dpkg -l | grep -i gstreamer1.0-plugins-bad
gst-inspect-1.0 --version
pkg-config --modversion gstreamer-plugins-bad-1.0
On other systems use your package manager's query, or check the version your application bundles. A version below 1.22.6 is affected according to the upstream advisory. Distributions often backport fixes without changing the upstream version number, so a lower number does not prove exposure. The record links a Debian LTS announcement for that reason, and your distribution's security tracker is the right place to confirm.
Also check container images. Media libraries are often pulled in as dependencies of something else, and they travel inside base images. You can also paste a manifest into the free in-browser dependency scan at gold.safeguard.sh/scan to see which known CVEs touch your packages.
What to do now
- Inventory hosts, containers and applications that include gst-plugins-bad, directly or through a media framework.
- Update to 1.22.6 or later, or to your distribution's fixed package, and restart the services that use it.
- For builds on older branches, apply the upstream patch linked in the advisory and rebuild.
- Where media files come from users or the internet, process them in a sandboxed worker with no secrets and no unneeded network access.
- Rescan images and manifests after the update to confirm the finding is closed.
Why it matters
As with its sibling, the record says an integer overflow occurs before a buffer is allocated. The size calculation wraps, the buffer is too small, and the copy that follows runs past it. The difference is only which part of the file triggers the path: AES3 audio data here, uncompressed video in the other.
The record notes that attack vectors vary with how the library is used. The library does the parsing, so the real exposure depends on where your application feeds it files or streams from outside. A thumbnailer, an upload pipeline or a media player on a desktop each look different on that question.
Quick check
Do I need to patch if my application never opens MXF files?
The vulnerable code is in a parser. If the plugin is installed and an input can be steered to it, it is reachable. If you can prove the file type is blocked upstream, urgency drops, but updating is still the cleaner answer.
Does the 1.22.6 update fix CVE-2023-40474 as well?
Yes for the upstream advisories. Both SA-2023-0006 and SA-2023-0007 name the gst-plugins-bad 1.22.6 releases as the fix, and the patch page covers both.
Sources
Last reviewed: 19 October 2026.
