CVE-2017-5847

High

Published: 09/02/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The gst_asf_demux_process_ext_content_desc function in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service via out-of-bounds heap read using extended content descriptors.

Risk Assessment

Attackers may exploit this vulnerability to disrupt application functionality, potentially leading to service outages.

Recommendation

It is recommended to update GStreamer to the latest version to mitigate this vulnerability and to monitor systems for unauthorized access attempts.

Other vulnerabilities in GStreamer gst-plugins-ugly

CVE-2026-112214Medium
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very large memory allocation request and lead to denial of service if the allocation fails or the process is memory-constrained.

Original NVD description (English source)

The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS