CVE-2017-5839

High

Published: 09/02/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The gst_riff_create_audio_caps function in gst-plugins-base in GStreamer before version 1.10.3 does not properly limit recursion, allowing remote attackers to cause a denial of service (stack overflow and crash) via nested WAVEFORMATEX.

Risk Assessment

Attackers can exploit this vulnerability to remotely trigger a system crash, potentially leading to service availability interruptions.

Recommendation

It is recommended to update GStreamer to version 1.10.3 or later to mitigate the risks associated with this vulnerability.

Other vulnerabilities in GStreamer, gst-plugins-base

CVE-2026-119842Medium
GStreamer's gst-plugins-base MicroDVD subtitle parser contains a NULL pointer dereference flaw. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD (.sub) subtitle file.

Original NVD description (English source)

The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, which allows remote attackers to cause a denial of service (stack overflow and crash) via vectors involving nested WAVEFORMATEX.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS