CVE-2009-0398

Array index error in the gst_qtp_trak_handler function in gst/qtdemux/qtdemux.c in GStreamer Plug...

9.3 HighFix available

Array index error in the gst_qtp_trak_handler function in gst/qtdemux/qtdemux.c in GStreamer Plug-ins (aka gstreamer-plugins) 0.6.0 allows remote attackers to have an unknown impact via a crafted QuickTime media file.

Exploit likelihood

3.19%Up 2.0 points since Feb 4, 2022

What each source reports

NVD Score used 9.3

Record: CVE-2009-0398
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-0398
Updated: 2026-11-02

EUVDEUVD-2009-0402 No score

Record: EUVD-2009-0402
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6qh3-3xvg-2wvc No score

Array index error in the gst_qtp_trak_handler function in gst/qtdemux/qtdemux.c in GStreamer Plug...

Record: GHSA-6qh3-3xvg-2wvc
Weakness: CWE-119
Updated: 2026-11-02

Affected products

gstreamer plug-ins

Affected packages

Affected packages
Package	Affected	Fixed
`gstreamer-plugins` Red Hat:enterprise_linux:3::as	before 0:0.6.0-19	0:0.6.0-19
`gstreamer-plugins-debuginfo` Red Hat:enterprise_linux:3::as	before 0:0.6.0-19	0:0.6.0-19
`gstreamer-plugins-devel` Red Hat:enterprise_linux:3::as	before 0:0.6.0-19	0:0.6.0-19
`gstreamer-plugins` Red Hat:enterprise_linux:3::desktop	before 0:0.6.0-19	0:0.6.0-19
`gstreamer-plugins-debuginfo` Red Hat:enterprise_linux:3::desktop	before 0:0.6.0-19	0:0.6.0-19
`gstreamer-plugins-devel` Red Hat:enterprise_linux:3::desktop	before 0:0.6.0-19	0:0.6.0-19
`gstreamer-plugins` Red Hat:enterprise_linux:3::es	before 0:0.6.0-19	0:0.6.0-19
`gstreamer-plugins-debuginfo` Red Hat:enterprise_linux:3::es	before 0:0.6.0-19	0:0.6.0-19
`gstreamer-plugins-devel` Red Hat:enterprise_linux:3::es	before 0:0.6.0-19	0:0.6.0-19
`gstreamer-plugins` Red Hat:enterprise_linux:3::ws	before 0:0.6.0-19	0:0.6.0-19
`gstreamer-plugins-debuginfo` Red Hat:enterprise_linux:3::ws	before 0:0.6.0-19	0:0.6.0-19
`gstreamer-plugins-devel` Red Hat:enterprise_linux:3::ws	before 0:0.6.0-19	0:0.6.0-19

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-0398 is a high vulnerability (CVSS 9.3) in Gstreamer Plug-ins, published February 3, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.19%, the 88th percentile. Fixed in gstreamer-plugins 0:0.6.0-19.

References

Show 6 moreShow less