CVE-2024-0444 is a high severity stack-based buffer overflow in GStreamer's AV1 video parsing, scored CVSS 8.8 in the record and 7.5 by the Zero Day Initiative. A crafted AV1 file can lead to code execution in the process that parses it. Apply your distribution's GStreamer update.
What's affected
The record names GStreamer with no version range. The Zero Day Initiative advisory, ZDI-24-567, dated 5 June 2024, says the flaw is in the parsing of tile list data in AV1 encoded video files. The cause is a missing check on the length of data before it is copied into a fixed size stack buffer.
The record links a fix commit in the GStreamer repository. We could not read it, and no fixed release number appears in the sources we read, so check your distribution's security notice or the GStreamer release notes for the version that carries the change.
The weaknesses are CWE-121, stack-based buffer overflow, and CWE-787, out-of-bounds write.
Source conflict: the record scores it 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. ZDI scores it 7.5 with AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The only difference is attack complexity, low in one and high in the other. Both agree on high impact for confidentiality, integrity and availability, and both are high severity. It is not on the CISA Known Exploited Vulnerabilities list.
ZDI notes that interaction with the library is required and that attack vectors may vary by implementation.
How to check if you're exposed
Start with the installed version:
gst-inspect-1.0 --version
pkg-config --modversion gstreamer-1.0
Then identify who feeds untrusted files to it. GStreamer sits under media players, thumbnailers, browsers on some platforms, video editors and server side transcoding. The riskiest use is any service that processes AV1 files uploaded by outsiders, since a parser flaw is reachable by whoever supplies the file.
Check your distribution's advisory for this CVE for the fixed package version, and container base images for GStreamer packages. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether it appears in dependencies you ship.
What to do now
- List hosts, desktops and container images with GStreamer installed.
- Install the update from your distribution that includes the fix commit.
- For services that transcode or thumbnail user uploads, run the work in a sandbox with a low privilege account and resource limits.
- If you cannot patch quickly, consider rejecting AV1 uploads in those services until you can.
- Restart long running processes that loaded the library so they pick up the fixed version.
Why it matters
Media parsers handle complicated binary formats written by other people, which makes them a steady source of memory safety bugs. A stack overflow in a parser can let a crafted file take over the process that opens it, with that process's rights.
The ZDI language is that attackers could execute code in the context of the current process. For a desktop media player that means the user's account. For a server that thumbnails uploads it can mean a service account with access to storage. Where the parser runs matters as much as the score.
Quick check
Which score is right for CVE-2024-0444, 8.8 or 7.5?
Both are published. The record says 8.8 and ZDI says 7.5, differing in attack complexity. Both rate impact high.
Do I need to open a file to be affected?
Yes. ZDI says interaction with the library is required, meaning a crafted AV1 file has to be parsed.
Sources
- Gold entry for CVE-2024-0444
- ZDI advisory ZDI-24-567
- GStreamer fix commit (linked by the record; page did not load)
Last reviewed: 19 October 2026.
