PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9809 Gstreamer CVE debrief

CVE-2016-9809 is an out-of-bounds read issue in GStreamer’s H.264 caps parsing logic. According to NVD, versions of GStreamer through 1.10.1 are affected, and the fix was released in 1.10.2. The vulnerability is associated with a high CVSS score (7.8) and should be treated as a priority for any environment that processes untrusted media content.

Vendor
Gstreamer
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-13
Original CVE updated
2026-05-13
Advisory published
2017-01-13
Advisory updated
2026-05-13

Who should care

Teams running applications or services that depend on GStreamer for media parsing or playback, especially where files may come from untrusted sources. This includes desktop multimedia applications, streaming or transcoding services, and Linux distribution maintainers responsible for packaged GStreamer builds.

Technical summary

NVD describes an off-by-one error in gst_h264_parse_set_caps that can trigger an out-of-bounds read when a crafted file is processed. The vulnerable CPE range covers GStreamer versions up to and including 1.10.1. The vendor release notes for 1.10.2 are listed as the fixing reference, and related issue tracking and distribution advisories are linked in the source corpus.

Defensive priority

High

Recommended defensive actions

  • Upgrade GStreamer to 1.10.2 or a vendor-patched version that includes the fix.
  • Inventory systems and applications that embed or depend on GStreamer, including packaged libraries in Linux distributions.
  • Prioritize remediation for services that accept or parse untrusted media files.
  • Apply vendor and distribution advisories referenced in the record, including Red Hat, Debian, and Gentoo notices where applicable.
  • Validate post-upgrade behavior with representative media workloads and monitor for parser crashes or abnormal warnings.

Evidence notes

The source corpus includes the NVD CVE record, GStreamer 1.10.2 release notes, a GNOME Bugzilla issue entry, and multiple distribution advisories (Red Hat, Debian, Gentoo). NVD lists the affected range as GStreamer versions through 1.10.1 and identifies CWE-125. The CVE was published on 2017-01-13; earlier reference links in the record date to December 2016, which supports that the issue was publicly discussed before the CVE publication date.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9809 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9809

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9809 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9809

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.