CVE-2017-5839 in GStreamer
Summary
by MITRE
The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, which allows remote attackers to cause a denial of service (stack overflow and crash) via vectors involving nested WAVEFORMATEX.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/17/2026
The vulnerability identified as CVE-2017-5839 represents a critical stack overflow issue within the GStreamer multimedia framework's base plugins. This flaw exists in the gst_riff_create_audio_caps function located in gst-libs/gst/riff/riff-media.c, affecting all versions prior to 1.10.3. The vulnerability stems from insufficient recursion limits during the processing of nested WAVEFORMATEX structures within RIFF media files, creating a path for remote attackers to exploit through carefully crafted malicious files. The issue manifests when the function fails to properly validate the depth of nested audio format structures, allowing recursive processing to consume excessive stack memory resources. This particular vulnerability falls under the CWE-674 weakness category, specifically addressing Uncontrolled Recursion, which is classified as a fundamental flaw in input validation and resource management. The attack vector involves sending specially crafted WAVEFORMATEX data structures that contain nested references, causing the function to recursively process the same data structure multiple times until the stack space is exhausted. The operational impact of this vulnerability is severe, as it enables remote attackers to trigger a denial of service condition that results in application crashes and system instability. When exploited, the vulnerability causes a stack overflow that leads to immediate process termination, effectively disrupting multimedia playback services and potentially affecting applications that rely on GStreamer for audio processing. This type of vulnerability is particularly dangerous in server environments where multimedia processing services are exposed to untrusted input sources, as it can be leveraged to continuously crash services and deny legitimate users access to functionality. The ATT&CK framework categorizes this vulnerability under the T1499.004 technique for Network Denial of Service, specifically targeting the application layer by exploiting memory corruption vulnerabilities. The exploitation requires minimal privileges and can be executed remotely, making it particularly attractive to threat actors seeking to disrupt services without requiring extensive access to target systems. The vulnerability demonstrates a classic example of insufficient input validation where the system fails to properly limit recursive operations, leading to resource exhaustion. Security researchers have noted that such flaws are particularly challenging to detect during development phases as they often require specific conditions to manifest, making them difficult to identify through standard testing procedures. The remediation strategy involves updating to GStreamer version 1.10.3 or later, which includes proper recursion depth limiting mechanisms within the affected function. Additionally, implementing input validation checks that monitor for excessive nesting levels in audio format structures provides an additional layer of protection. Organizations should also consider implementing network segmentation and access controls to limit exposure to untrusted input sources. The vulnerability highlights the importance of proper resource management in multimedia processing libraries and underscores the need for thorough testing of recursive parsing functions. Security teams should monitor for potential exploitation attempts and ensure that all GStreamer-based applications are updated to versions that address this specific recursion vulnerability, as the impact extends beyond simple crashes to potentially enable more sophisticated attack vectors through service disruption.