CVE-2023-50186 is a high severity (CVSS 8.8) buffer overflow in the AV1 codec parser of GStreamer. A crafted AV1 video can crash an application and possibly lead to code execution. The GStreamer project fixed it in gst-plugins-bad 1.22.8. Update the package, or apply your distribution's patch.
What's affected
- GStreamer gst-plugins-bad before 1.22.8, per the project advisory GStreamer-SA-2023-0011.
- Fixed in 1.22.8. For older branches, the project says to apply the patch and recompile.
- The NVD record lists GStreamer without version bounds, so rely on the project advisory for the range.
- The two sources differ on the class of overflow. The record, based on the Zero Day Initiative report, calls it a stack based buffer overflow. The GStreamer advisory calls it a heap based buffer overflow. Both agree the AV1 parser is the location and both give code execution as a possibility.
- User interaction is required, since a user or application has to process a malicious file or stream.
- KEV status: the record shows kev as false.
How to check if you're exposed
Check the installed GStreamer and plugin versions on hosts that process video, such as media servers, thumbnail services and desktop apps.
gst-inspect-1.0 --version
dpkg -l | grep gstreamer1.0-plugins-bad
rpm -q gstreamer1-plugins-bad-free
Linux distributions often backport fixes without changing the version number, so also check your distribution's security notes for CVE-2023-50186. For container images, scan the image rather than guessing. The free scanner at gold.safeguard.sh/scan can help list GStreamer packages in a dependency manifest.
What to do now
- Find systems that decode untrusted video with GStreamer, including inside container images and bundled applications.
- Update gst-plugins-bad to 1.22.8 or later, or install your distribution's patched build.
- For older branches that cannot move, apply the project patch and recompile.
- Run media processing in a sandbox or low privilege account, since the code would run as the process that handles the file.
- Restrict which sources can submit video to automatic processing pipelines.
Why it matters
The record lists CWE-121 and CWE-787: an out of bounds write caused by copying data into a fixed size buffer without checking its length. The description says the problem appears when parsing metadata inside AV1 encoded files, where the length of attacker supplied data is not validated.
Media libraries are a frequent target because they parse complex formats from untrusted sources, often automatically, for example when generating a preview. That makes an app that never plays a video still part of the exposure.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is it a stack or a heap overflow?
The sources differ. The NVD record says stack based, the GStreamer advisory says heap based. Either way the fix is gst-plugins-bad 1.22.8 or later.
Can code run without anyone opening a file?
The record says interaction with the library is required, but pipelines that process uploads automatically may meet that condition without a person involved.
Sources
- NVD record for CVE-2023-50186
- GStreamer Security Advisory 2023-0011
- Zero Day Initiative advisory ZDI-24-368
Last reviewed: 19 October 2026.
