# CVE-2016-9634: GStreamer heap buffer overflow in FLIC decoder

Source: https://junglewise.ai/threats/cve-2016-9634-gstreamer-heap-buffer-overflow-in-flic-decoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-27. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-9634 · Severity: critical · CVSS 9.8 · Published 2017-01-27

GStreamer is a widely used framework for handling multimedia files like videos and audio. A vulnerability in its FLIC video decoder allows a remote attacker to potentially take control of a computer or crash applications by tricking the system into processing a specially crafted media file. This could lead to unauthorized access to sensitive data or a complete disruption of services that rely on GStreamer for media playback.

Technologies: [Debian Linux](https://junglewise.ai/threats/technologies/debian), [Gstreamer](https://junglewise.ai/threats/technologies/gstreamer), [Red Hat GStreamer Plugins Good](https://junglewise.ai/threats/technologies/gstreamer-plugins-good), [Redhat Enterprise Linux Desktop](https://junglewise.ai/threats/technologies/enterprise-linux-desktop), [Redhat Enterprise Linux Hpc Node](https://junglewise.ai/threats/technologies/enterprise-linux-hpc-node), [Redhat Enterprise Linux Server](https://junglewise.ai/threats/technologies/enterprise-linux-server), [Redhat Enterprise Linux Workstation](https://junglewise.ai/threats/technologies/enterprise-linux-workstation). Vendors: [Debian](https://junglewise.ai/threats/vendors/debian), [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer), [Red Hat](https://junglewise.ai/threats/vendors/red-hat), [Redhat](https://junglewise.ai/threats/vendors/redhat).

## Quick answers

**Is CVE-2016-9634 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-9634 being exploited in the wild.

**How severe is CVE-2016-9634?** Critical severity, with a CVSS score of 9.8, published 27 January 2017.

**Which products and versions are affected?** GStreamer GStreamer before 1.10.2; Red Hat gstreamer-plugins-good Enterprise Linux 6, Enterprise Linux 7; Debian debian_linux 8.0.

**Is there a fix for CVE-2016-9634?** A patch was published on 2016-12-21: Red Hat released security updates for RHEL 6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-9634 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2016-9634?** Check whether you run Debian Linux, Gstreamer, Red Hat GStreamer Plugins Good or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in the flx_decode_delta_fli function within gst/flx/gstflxdec.c of the GStreamer FLIC decoder. The vulnerability is triggered by an improper handling of the start_line parameter in FLIC media files. A remote, unauthenticated attacker can exploit this by providing a specially crafted FLIC file to an application using the GStreamer library. Successful exploitation can lead to arbitrary code execution with the privileges of the user running the application or a denial of service (application crash). The issue was addressed in GStreamer version 1.10.2; some distributions like Red Hat opted to remove the vulnerable plug-in as a mitigation.

## Affected products

- GStreamer GStreamer before 1.10.2
- Red Hat gstreamer-plugins-good Enterprise Linux 6, Enterprise Linux 7
- Debian debian_linux 8.0

## Timeline

- 2016-11-24: disclosed: Public disclosure via oss-security mailing list
- 2016-12-21: patched: Red Hat released security updates for RHEL 6
- 2017-01-05: patched: Red Hat released security updates for RHEL 7
- 2017-01-27: advisory: NVD published CVE-2016-9634

## References

- [http://rhn.redhat.com/errata/RHSA-2016-2975.html](http://rhn.redhat.com/errata/RHSA-2016-2975.html)
- [http://rhn.redhat.com/errata/RHSA-2017-0019.html](http://rhn.redhat.com/errata/RHSA-2017-0019.html)
- [http://rhn.redhat.com/errata/RHSA-2017-0020.html](http://rhn.redhat.com/errata/RHSA-2017-0020.html)
- [http://www.debian.org/security/2016/dsa-3723](http://www.debian.org/security/2016/dsa-3723)
- [http://www.debian.org/security/2016/dsa-3724](http://www.debian.org/security/2016/dsa-3724)
- [http://www.openwall.com/lists/oss-security/2016/11/24/2](http://www.openwall.com/lists/oss-security/2016/11/24/2)
- [http://www.securityfocus.com/bid/94499](http://www.securityfocus.com/bid/94499)

## Related threats

- [GStreamer MXF demuxer off-by-one buffer write](https://junglewise.ai/threats/cve-2026-125707-a-flaw-was-found-in-gstreamer-s-mxf-demuxer-when-an-application)
- [GStreamer core buffer value deserialization use-after-free](https://junglewise.ai/threats/cve-2026-125704-a-use-after-free-flaw-was-found-in-gstreamer-core-buffer-value)
- [GStreamer integer overflow in AV1 LEB128 parser](https://junglewise.ai/threats/cve-2026-119729-a-flaw-was-found-in-gstreamer-an-integer-overflow-vulnerability)
- [GStreamer rtpL16depay heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-111183-gstreamer-rtpl16depay-heap-based-buffer-overflow-remote-code)
- [GStreamer rtpsbcdepay use-after-free in RTP SBC payload parsing](https://junglewise.ai/threats/cve-2026-18299-gstreamer-rtpsbcdepay-use-after-free-in-rtp-sbc-payload-parsing)