CVE-2024-4453 is a High (CVSS 7.8) integer overflow in GStreamer's EXIF metadata parsing, with 1.24.0 and 1.24.1 listed in the record. A crafted image can lead to code execution in the process that parses it. GStreamer issued a fix, so apply it or your distribution's update.
What's affected
- Product: GStreamer, with versions 1.24.0 and 1.24.1 in the record's CPE entries, plus Debian Linux 10.0.
- Fixed version: the record links a GStreamer commit (e68eccff). ZDI says GStreamer issued an update. I did not find a release number in what I read. The record links a Debian LTS announcement, which would list package versions, but it did not load for me.
- Severity: High, CVSS 7.8. The vector is local with user interaction, even though ZDI's text calls it remote code execution.
- Trigger: parsing EXIF metadata, where a size calculation overflows before a buffer is allocated.
- Exploitation: KEV is false. ZDI's timeline shows a report on 2024-04-17 and public release on 2024-05-17.
How to check if you're exposed
On a host, check the installed version:
gst-inspect-1.0 --version
dpkg -l | grep -i gstreamer
Package versions on Debian and Ubuntu carry backported fixes, so the upstream number alone does not tell you the whole story. Check the distribution security tracker for CVE-2024-4453.
Also think about what uses GStreamer on your systems. Media players, thumbnailers, and apps that handle photos or video all may parse EXIF data from files that users did not create.
What to do now
- Check GStreamer versions on workstations, servers and container images.
- Install your distribution's security update for GStreamer packages.
- Rebuild container images that bundle GStreamer, and scan them afterward.
- Limit which services parse images from untrusted users, and run them with reduced privileges.
- Look at the upstream commit and Debian announcement the record links for the exact fixed package.
Why it matters
The record maps this to CWE-190, integer overflow or wraparound. A length is computed from values in the file, the math wraps around to a small number, and the program allocates a buffer that is too small. Copying the real data into it overwrites memory.
Media libraries are a frequent target because they parse complex formats from untrusted files, and many applications pull them in as a dependency. That makes it hard to know where they run, which is why an inventory helps.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this remote code execution?
ZDI's title says so, but the CVSS vector is local with user interaction. The file has to be opened or processed by something that uses GStreamer.
Which release fixes it?
I could not confirm a release number. The record links the upstream commit and a Debian LTS notice.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4453 (published 2024-05-22) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
