PT-2026-38023 · Bitnami · Java-Min
Published
2026-05-06
·
Updated
2026-05-06
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux parse theora extension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended value when cast to an unsigned integer. This 32-bit negative value is then cast to a 64-bit unsigned integer (0xfffffffffffffffa) in a subsequent call to gst buffer new and alloc. The function gst buffer new allocate then attempts to allocate memory, eventually calling sysmem new block. The function sysmem new block adds alignment and header size to the (unsigned) size, causing the overflow of the 'slice size' variable. As a result, only 0x89 bytes are allocated, despite the large input size. When the following memcpy call occurs in gst buffer fill, the data from the input file will overwrite the content of the GstMapInfo info structure. Finally, during the call to gst memory unmap, the overwritten memory may cause a function pointer hijack, as the mem->allocator->mem unmap full function is called with a corrupted pointer. This function pointer overwrite could allow an attacker to alter the execution flow of the program, leading to arbitrary code execution. This vulnerability is fixed in 1.24.10.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Java-Min