CVE-2016-9812 in GStreamer
Summary
by MITRE
The gst_mpegts_section_new function in the mpegts decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a too small section.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/13/2026
The vulnerability identified as CVE-2016-9812 represents a critical out-of-bounds read flaw within the GStreamer multimedia framework's MPEG-TS section handling mechanism. This issue affects versions prior to 1.10.2 and stems from inadequate input validation in the gst_mpegts_section_new function. The flaw specifically manifests when processing MPEG-TS (MPEG Transport Stream) packets where the section data is insufficiently sized, creating a condition where the decoder attempts to read memory beyond the allocated buffer boundaries.
The technical implementation of this vulnerability involves the mpegts decoder component within GStreamer which is responsible for parsing and processing MPEG-TS streams commonly used in broadcast television and streaming applications. When the gst_mpegts_section_new function receives a section with insufficient data, it fails to properly validate the section length against the expected buffer size. This validation gap allows an attacker to craft malicious MPEG-TS packets with intentionally truncated section data, causing the decoder to access memory locations that fall outside the legitimate data boundaries.
From an operational perspective, this vulnerability presents a significant denial of service risk that can be exploited remotely without authentication. Attackers can send specially crafted MPEG-TS streams to systems processing these media formats, potentially causing application crashes, system instability, or complete service interruption. The impact extends beyond simple service disruption as it can affect media servers, streaming platforms, and any system that relies on GStreamer for MPEG-TS processing. The vulnerability's remote exploitability means that systems processing untrusted media streams are particularly at risk, making it a critical concern for network infrastructure and content delivery platforms.
The flaw aligns with CWE-125, which specifically addresses out-of-bounds read vulnerabilities, and demonstrates characteristics consistent with ATT&CK technique T1499.003 for network denial of service attacks. The vulnerability's exploitation requires minimal privileges and can be automated, making it particularly dangerous in environments where media processing systems are exposed to untrusted input sources. Organizations using GStreamer for media processing should consider this vulnerability as a high-priority remediation target, particularly in systems handling live streaming, broadcast processing, or any application where media input cannot be fully trusted.
Mitigation strategies should focus on immediate patching to GStreamer version 1.10.2 or later, which includes proper bounds checking and input validation for MPEG-TS section processing. Additionally, network-level filtering can be implemented to validate section lengths before they reach the GStreamer processing components, though this approach may introduce additional latency or processing overhead. System administrators should also consider implementing monitoring solutions to detect anomalous MPEG-TS packet patterns that might indicate exploitation attempts, while maintaining regular updates to ensure protection against similar vulnerabilities in the broader GStreamer ecosystem.