CVE-2016-10199 in GStreamer
Summary
by MITRE
The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted tag value.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/17/2026
The vulnerability identified as CVE-2016-10199 resides within the GStreamer multimedia framework's gst-plugins-good module, specifically in the qtdemux_tag_add_str_full function located in gst/isomp4/qtdemux.c. This flaw represents a classic buffer over-read condition that can be exploited by remote attackers to trigger a denial of service scenario. The issue manifests when processing crafted tag values within QuickTime media files, which are commonly used in multimedia applications and streaming services. The vulnerability affects GStreamer versions prior to 1.10.3, making it a significant concern for systems that rely on older versions of this popular multimedia framework.
The technical exploitation of this vulnerability occurs through improper bounds checking within the qtdemux_tag_add_str_full function. When the function processes a specially crafted tag value, it fails to validate the length or content of the input data before attempting to read from memory locations that may extend beyond the allocated buffer boundaries. This out-of-bounds memory access results in unpredictable behavior including application crashes, memory corruption, and ultimately denial of service conditions. The flaw operates at the level of media file parsing and tag handling, making it particularly dangerous in environments where users can upload or stream media content without proper validation. This vulnerability type maps directly to CWE-125: Out-of-bounds Read as defined in the Common Weakness Enumeration catalog.
From an operational impact perspective, this vulnerability creates substantial risk for multimedia applications, streaming services, and content delivery platforms that utilize GStreamer for media processing. Attackers can remotely cause service disruption by simply providing maliciously formatted media files that trigger the out-of-bounds read condition. The crash occurs during normal media file parsing operations, meaning that even legitimate users could inadvertently trigger the vulnerability if they encounter specially crafted content. This makes the vulnerability particularly dangerous in web applications where users can upload media files or in streaming environments where content from untrusted sources flows through the system. The ATT&CK framework categorizes this as a Denial of Service attack technique under the T1499.004 sub-technique for Network Denial of Service, as it specifically targets the availability of multimedia processing services.
Mitigation strategies for CVE-2016-10199 primarily involve upgrading to GStreamer version 1.10.3 or later, which includes the necessary patches to address the buffer over-read condition. System administrators should prioritize patching affected installations, particularly in environments where media files are processed from untrusted sources. Additional defensive measures include implementing strict input validation for media file content, deploying network monitoring to detect unusual traffic patterns associated with exploitation attempts, and establishing robust media processing sandboxing to contain potential impacts. Organizations should also consider implementing automated vulnerability scanning tools that can detect the presence of vulnerable GStreamer versions in their infrastructure. The remediation process must be carefully managed to ensure that patching does not introduce compatibility issues with existing multimedia applications while maintaining the security posture against this specific denial of service vulnerability.