PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9813 Gstreamer CVE debrief

CVE-2016-9813 is a denial-of-service issue in GStreamer’s mpegts parser. According to NVD, the _parse_pat function in GStreamer before 1.10.2 can be crashed by a crafted file, leading to a NULL pointer dereference. The impact is availability-only, and the published CVSS 3.0 vector reflects local execution with required user interaction.

Vendor
Gstreamer
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-13
Original CVE updated
2026-05-13
Advisory published
2017-01-13
Advisory updated
2026-05-13

Who should care

Administrators and developers who deploy or embed GStreamer, especially applications that process untrusted media files using the mpegts parser. Security teams responsible for desktop, media-processing, or pipeline-based systems should verify whether any installed GStreamer package is older than 1.10.2.

Technical summary

NVD identifies a CWE-476 NULL pointer dereference in the mpegts parser’s _parse_pat function. The affected CPE range is GStreamer versions up to and including 1.10.1. A crafted file can trigger a crash, producing a denial of service rather than code execution or data theft based on the supplied record.

Defensive priority

Medium. The issue is a crash-triggering availability flaw with CVSS 5.5, but it requires local execution and user interaction. Prioritize systems that routinely open untrusted media or that expose GStreamer-based processing to external content.

Recommended defensive actions

  • Upgrade GStreamer to 1.10.2 or later, as referenced by the vendor release notes.
  • Inventory systems and applications that bundle or dynamically link GStreamer and confirm the installed version is not affected.
  • Treat untrusted media files as a risk input and route them through patched builds before processing.
  • If immediate upgrading is not possible, restrict handling of untrusted files on exposed systems until remediation is complete.
  • Validate vendor and distro advisories for package-specific backports, such as the referenced Red Hat and Debian notices.

Evidence notes

The vulnerability description, affected version range, weakness classification, and CVSS vector come from the supplied NVD record. References include the GStreamer 1.10.2 release notes, GNOME bug tracker entry 775120, and distro advisories from Red Hat and Debian. The record is published on 2017-01-13 and later modified on 2026-05-13; those dates are used only as record timing context.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9813 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9813

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9813 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9813

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.