PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5843 Gstreamer CVE debrief

CVE-2017-5843 describes multiple use-after-free flaws in GStreamer’s object and tag-list cleanup paths. According to the supplied NVD record, attackers could trigger a crash remotely by sending crafted media streams or stream tags, with the issue demonstrated by an MXF sample file. The vendor-fixed boundary is GStreamer 1.10.3, and NVD rates the impact as availability-only denial of service.

Vendor
Gstreamer
Product
CVE-2017-5843
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-09
Original CVE updated
2026-05-13
Advisory published
2017-02-09
Advisory updated
2026-05-13

Who should care

Operators and developers using GStreamer 1.10.2 or earlier, especially where untrusted media is parsed or demuxed. Security teams for distributions that package GStreamer should also verify patched builds and downstream advisories.

Technical summary

The vulnerability is mapped to CWE-416 (use-after-free) and affects three functions named in the NVD description: gst_mini_object_unref, gst_tag_list_unref, and gst_mxf_demux_update_essence_tracks. The supplied CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a remotely triggerable crash with no required privileges or user interaction and no supported confidentiality or integrity impact in the record.

Defensive priority

High: remotely reachable media-parsing flaws can crash applications processing untrusted content, so versions at or below 1.10.2 should be treated as urgent to patch.

Recommended defensive actions

  • Upgrade GStreamer to 1.10.3 or later, which the vendor release notes identify as the fixed version.
  • Inventory systems and applications using GStreamer 1.10.2 or earlier, including embedded media processing components.
  • Apply downstream security updates from distributors referenced in the record, such as Debian, Red Hat, and Gentoo, where applicable.
  • Treat untrusted media and stream tags as high-risk inputs until patched versions are deployed.
  • Validate that crash handling, monitoring, and service restart controls are in place for media-processing workloads.

Evidence notes

The supplied corpus ties the issue to the official NVD entry, the CVE record, and GStreamer 1.10.3 release notes. NVD lists the vulnerable version range as up to and including 1.10.2 and classifies the weakness as CWE-416. The description explicitly says the impact is denial of service/crash via stream-tag-related vectors. Timeline context should use the CVE published date of 2017-02-09; the later 2026-05-13 modified date reflects record updates, not the original disclosure date.

Official resources

Publicly disclosed on 2017-02-09. The NVD record was later modified on 2026-05-13, but that later timestamp is only record maintenance and should not be treated as the vulnerability date.