Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2024-47540

Use of Uninitialized Variable

Published: Dec 12, 2024 | Modified: Nov 03, 2025
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
8.8 IMPORTANT
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2024-47540
CWEhttps://cwe.mitre.org/data/definitions/457.html

GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matroska_demux_add_wvpk_header function within matroska-demux.c. When size < 4, the program calls gst_buffer_unmap with an uninitialized map variable. Then, in the gst_memory_unmap function, the program will attempt to unmap the buffer using the uninitialized map variable, causing a function pointer hijack, as it will jump to mem->allocator->mem_unmap_full or mem->allocator->mem_unmap. This vulnerability could allow an attacker to hijack the execution flow, potentially leading to code execution. This vulnerability is fixed in 1.24.10.

Weakness

The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

Affected Software

NameVendorStart VersionEnd Version
GstreamerGstreamer_project*1.24.10 (excluding)
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRedHatgstreamer1-plugins-base-0:1.10.4-3.el7_9*
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRedHatgstreamer1-plugins-good-0:1.10.4-3.el7_9*
Red Hat Enterprise Linux 8RedHatgstreamer1-plugins-good-0:1.16.1-5.el8_10*
Red Hat Enterprise Linux 8.2 Advanced Update SupportRedHatgstreamer1-plugins-good-0:1.16.1-2.el8_2*
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRedHatgstreamer1-plugins-good-0:1.16.1-3.el8_4*
Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceRedHatgstreamer1-plugins-good-0:1.16.1-3.el8_4*
Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsRedHatgstreamer1-plugins-good-0:1.16.1-3.el8_4*
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRedHatgstreamer1-plugins-good-0:1.16.1-3.el8_6*
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRedHatgstreamer1-plugins-good-0:1.16.1-3.el8_6*
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRedHatgstreamer1-plugins-good-0:1.16.1-3.el8_6*
Red Hat Enterprise Linux 8.8 Extended Update SupportRedHatgstreamer1-plugins-good-0:1.16.1-4.el8_8*
Red Hat Enterprise Linux 9RedHatgstreamer1-plugins-good-0:1.22.1-3.el9_5*
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRedHatgstreamer1-plugins-good-0:1.18.4-6.el9_0*
Red Hat Enterprise Linux 9.2 Extended Update SupportRedHatgstreamer1-plugins-good-0:1.18.4-7.el9_2*
Red Hat Enterprise Linux 9.4 Extended Update SupportRedHatgstreamer1-plugins-good-0:1.22.1-3.el9_4*
Gst-plugins-good1.0Ubuntuesm-infra/focal*
Gst-plugins-good1.0Ubuntufocal*
Gst-plugins-good1.0Ubuntujammy*
Gst-plugins-good1.0Ubuntunoble*
Gst-plugins-good1.0Ubuntuoracular*
Gst-plugins-good1.0Ubuntuupstream*

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use