CVE-2023-44429 is a high severity heap-based buffer overflow in the GStreamer AV1 codec parser, scored 8.8. It is fixed in the gst-plugins-bad 1.22.7 release. Older branches need the patch applied and a rebuild. Update the package, then check media pipelines that accept video from outside your control.
What's affected
The GStreamer advisory GStreamer-SA-2023-0009 lists the affected component as gst-plugins-bad before version 1.22.7. The bug is in the AV1 codec parser and is triggered by certain malformed streams. The advisory is dated 13 November 2023 and ties the issue to ZDI-CAN-22226.
The fix is the gst-plugins-bad 1.22.7 release. For older branches, the advisory says to apply the patch and recompile. Linux distributions package GStreamer themselves and often backport fixes without moving the version number, so check your distribution notice as well.
The NVD record was published on 2024-05-03 with a score of 8.8 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. ZDI publishes the same score. The two sources differ on impact wording: ZDI says an attacker can execute code in the context of the current process, while GStreamer says the issue can crash the application and possibly lead to code execution through heap manipulation. Read both as describing the same risk, with code execution as the worst case.
Weakness class: CWE-122 (heap-based buffer overflow), CWE-787 (out-of-bounds write).
How to check if you're exposed
Find out which GStreamer version your system provides. On most Linux systems:
gst-inspect-1.0 --version
The vulnerable component is the gst-plugins-bad package, so check it too. On Debian or Ubuntu:
dpkg -l | grep -i gstreamer1.0-plugins-bad
On Fedora or RHEL style systems, use rpm -qa | grep gstreamer1-plugins-bad. A version below 1.22.7 needs attention, but confirm against your distribution advisory because a backported fix can sit under an older version string. Applications that bundle their own GStreamer, such as some desktop apps and containers, have to be checked separately.
What to do now
- List the hosts, containers and desktop apps that use GStreamer, with the gst-plugins-bad version of each.
- Upgrade gst-plugins-bad to 1.22.7 or later, or install your distribution's patched package.
- For a branch you build yourself, apply the upstream patch referenced in the advisory and recompile.
- Rebuild container images that bundle GStreamer so the new libraries ship in your next deployment.
- Until patched, avoid feeding untrusted AV1 files to server side media pipelines, thumbnailers and transcoders.
Why it matters
The parser copies data from the video stream into a fixed-length heap buffer without checking how long the data is. A crafted AV1 file can write past the end of that buffer. The weakness is tracked as CWE-122 for the heap overflow and CWE-787 for the out-of-bounds write.
Media libraries sit behind many features that do not look like media features: preview generation, upload processing, chat apps and file managers. The CVSS vector marks user interaction as required, because something has to open or process the file, but in automated pipelines that step happens without a person. Whether you are affected depends on whether your code ever reaches the AV1 parser. That is a reachability question, and the demo below shows how reachability narrows a long findings list to the few that matter.
CVE-2023-44429 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2023-44429?
The GStreamer advisory says the gst-plugins-bad 1.22.7 release addresses it. Older branches need the patch applied and a rebuild.
Does the bug need user interaction?
The score says yes, because a malformed file must be processed. In an automated pipeline, uploading the file can be enough to trigger processing.
Sources
Last reviewed: 19 October 2026.
