CVE-2023-44446 is a high severity use-after-free flaw in the GStreamer MXF demuxer, scored 8.8 by NVD. GStreamer fixed it in the gst-plugins-bad 1.22.7 release. Update the package and rebuild any image that bundles it. The project and the Zero Day Initiative describe the impact differently, and both views are given below.
What's affected
The GStreamer advisory GStreamer-SA-2023-0010 names gst-plugins-bad before 1.22.7 as affected. The flaw is a use after free (a read) in the MXF demuxer, reached when certain files are handled. The advisory is dated 13 November 2023 and ties the issue to ZDI-CAN-22299.
The fix is the gst-plugins-bad 1.22.7 release. Older branches need the patch applied and a rebuild. The record also links a Debian LTS announcement, which I could not load. Debian and other distributions may carry the fix under their own package versions.
The sources disagree on impact. NVD and ZDI score it 8.8 and describe code execution in the context of the current process, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The GStreamer advisory says only that a malicious third party can trigger a crash in the application. Both are published statements. For planning, assume the NVD view and treat the crash as the floor.
Weakness class: CWE-416 (use after free).
How to check if you're exposed
Check the GStreamer version and the plugins-bad package on each system. On Debian or Ubuntu:
gst-inspect-1.0 --version
dpkg -l | grep -i gstreamer1.0-plugins-bad
On Fedora or RHEL style systems, use rpm -qa | grep gstreamer1-plugins-bad. Anything below 1.22.7 needs a closer look, though a distribution may have backported the fix. If you ship an application or container with its own GStreamer build, read the version from the image or the application documentation.
What to do now
- Inventory the hosts, containers and apps that include gst-plugins-bad.
- Move to gst-plugins-bad 1.22.7 or later, or the patched package from your distribution.
- If you build GStreamer from source on an older branch, apply the patch from the advisory and recompile.
- Rebuild and redeploy container images so the updated libraries are in the running version.
- Where possible, keep MXF files from untrusted sources away from automated thumbnail and transcode jobs until the update lands.
Why it matters
A use-after-free bug happens when code keeps using an object after it has been released. In this case the advisory says the demuxer does not check that an object exists before it works on it. The weakness is tracked as CWE-416. Depending on what ends up in that memory, the result can be a crash or something worse, which explains the difference between the GStreamer and ZDI descriptions.
MXF is a professional video container, so many teams will never open one by hand. The risk is in the automated paths: media ingestion, preview generation and conversion services that accept files from users. If your code never calls the MXF demuxer, the finding is lower priority in practice. The exploitability check demo shows how to weigh a high score against the real conditions in your environment. CVE-2023-44446 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2023-44446 a crash or code execution?
The sources differ. GStreamer says a crash can be triggered, while NVD and ZDI describe code execution in the current process. Patch either way.
What fixes CVE-2023-44446?
The gst-plugins-bad 1.22.7 release, per the GStreamer advisory. Older branches need the patch and a rebuild.
Sources
Last reviewed: 19 October 2026.
