CVE-2017-5840 is a denial-of-service vulnerability affecting GStreamer versions prior to 1.10.3, specifically within the gst-plugins-good component. It allows remote attackers to trigger an out-of-bounds heap read by manipulating the current stts index during the parsing of samples in MP4 files. The vulnerability carries a CVSS v3 score of 7.5 (High), indicating a critical impact with low attack complexity and no user interaction required, leading to a denial of service. There is no known public exploit code, Metasploit modules, or Nuclei templates available, and it has not been added to CISA's KEV catalog. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public awareness or active exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.10.2CPE matchmatch criteria | cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.