CVE-2016-9813

Published: Jan 13, 2017Updated: May 13, 2026 Sources: CVE List NVDCWE-476

5.5MEDIUM

NVD MITRE

Description

The _parse_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.

In plain language

AI Worth attention

If your business uses GStreamer versions before 1.10.2, a specially crafted video file can make the program crash when a user opens it—this is usually only a risk if someone can trick your staff into viewing that file.

Executive summary

In GStreamer before 1.10.2, the mpegts parser’s _parse_pat handling can dereference a NULL pointer when processing a crafted media file, allowing remote attackers to trigger a denial-of-service crash via user-opening of the file.

If affected, business impact

Application crashService disruptionWorkflow interruptionPotential loss of business uptime

What to do now

Check your installed GStreamer version(s) and confirm whether any are earlier than 1.10.2.
Update GStreamer to 1.10.2 or later using your normal software update method.
If you cannot update right away, prevent staff from opening or previewing media from untrusted sources until patched.

Patch / advisory Some work to apply

What is it

This vulnerability is like a “bad video file” that can confuse a media-reading component and make the program crash. It doesn’t silently steal data; instead it can stop your media app from working, similar to a document that crashes the app when you try to open it.

Who is affected

This matters if you use GStreamer to play, parse, or process MPEG-TS media (for example in media playback tools or media pipelines). It’s mainly a risk when an attacker can get a user to open or process a crafted file. In practice, it’s not a constant online risk—it depends on reaching a user through file delivery or social engineering and the user interacting with that file.

How urgent is it

Treat this as AMBER: attackers can use crafted media files to crash the application, and a public exploit exists. It’s not about breaking in remotely without interaction, but the crash risk can still disrupt operations when users are tricked into opening untrusted content.

What to do — in detail

Confirm exposure (version check):
- On the system(s) running GStreamer, identify the installed version(s).
- Determine whether any are prior to 1.10.2.
Upgrade to the fixed version:
- Upgrade GStreamer to 1.10.2 or later (the vendor remediation points to the 1.10.2 release).
- If you manage software via distributions or an internal repo, align to the first package release that includes the 1.10.2 code.
Temporary workaround if patching is delayed:
- Block or restrict opening/previewing of video files received from untrusted sources (email attachments, random downloads, external links).
- Where possible, route incoming media through a controlled process or scanning step before staff open it.
Validate the fix:
- After upgrading, re-test your normal media workflows that parse MPEG-TS content.
- Confirm the application no longer terminates unexpectedly when processing media.
What to monitor:
- Look for crashes of the media application or related GStreamer processes occurring at the time staff open external media files.
- Review logs around media parsing events to identify any recurring failure pattern until everything is updated.

Technical context

This is a denial-of-service issue (CWE-476: NULL pointer dereference) in the mpegts parser’s _parse_pat function in GStreamer before 1.10.2. The attack is driven by processing a crafted file: an attacker needs a remote way to get a user to open or otherwise handle that media, after which the parser can hit a NULL dereference and crash the application. KEV is not listed, but there is a public exploit available, and press attention is rising—both of which support treating this seriously as an availability risk. The fix is provided in the GStreamer 1.10.2 release line.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.