# CVE-2016-9636: GStreamer heap buffer overflow in FLIC decoder Source: https://junglewise.ai/threats/cve-2016-9636-gstreamer-heap-buffer-overflow-in-flic-decoder Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2017-01-27. Updated: 2026-05-13 License: CC BY 4.0 with a link back CVE-2016-9636 · Severity: critical · CVSS 9.8 · Published 2017-01-27 GStreamer is a widely used multimedia framework that allows applications to play and process video and audio files. A vulnerability in its FLIC video decoder allows a remote attacker to potentially take control of a system or crash applications by providing a specially crafted video file. This affects any software using the GStreamer library to handle media, potentially leading to unauthorized data access or service disruptions. Technologies: [Debian Linux](https://junglewise.ai/threats/technologies/debian), [Gstreamer](https://junglewise.ai/threats/technologies/gstreamer), [Red Hat GStreamer Plugins Good](https://junglewise.ai/threats/technologies/gstreamer-plugins-good), [Redhat Enterprise Linux Desktop](https://junglewise.ai/threats/technologies/enterprise-linux-desktop), [Redhat Enterprise Linux Hpc Node](https://junglewise.ai/threats/technologies/enterprise-linux-hpc-node), [Redhat Enterprise Linux Server](https://junglewise.ai/threats/technologies/enterprise-linux-server), [Redhat Enterprise Linux Workstation](https://junglewise.ai/threats/technologies/enterprise-linux-workstation). Vendors: [Debian](https://junglewise.ai/threats/vendors/debian), [Gstreamer](https://junglewise.ai/threats/vendors/gstreamer), [Red Hat](https://junglewise.ai/threats/vendors/red-hat), [Redhat](https://junglewise.ai/threats/vendors/redhat). ## Quick answers **Is CVE-2016-9636 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-9636 being exploited in the wild. **How severe is CVE-2016-9636?** Critical severity, with a CVSS score of 9.8, published 27 January 2017. **Which products and versions are affected?** Red Hat GStreamer Plugins Good Enterprise Linux 6, Enterprise Linux 7. **Is there a fix for CVE-2016-9636?** A patch was published on 2016-12-21: Red Hat released security updates for RHEL 6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2016-9636 attacked?** It is attacked over the network, in a software library. **Am I affected by CVE-2016-9636?** Check whether you run Debian Linux, Debian Project Debian GNU/Linux, Gstreamer or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## Technical details A heap-based buffer overflow exists in the flx_decode_delta_fli function within gst/flx/gstflxdec.c of the GStreamer FLIC decoder. The vulnerability is triggered when the decoder processes a 'write count' value that exceeds the bounds of the initialized destination buffer. A remote, unauthenticated attacker can exploit this by providing a malicious FLIC (.fli/.flc) media file. Successful exploitation can lead to arbitrary code execution with the privileges of the user running the GStreamer-linked application or a denial of service (application crash). The issue was addressed in GStreamer version 1.10.2, and various Linux distributions (Red Hat, Debian, Gentoo) have released patches that either fix the code or remove the vulnerable plugin. ## Affected products - GStreamer GStreamer before 1.10.2 - Red Hat gstreamer-plugins-good Enterprise Linux 6, Enterprise Linux 7 - Debian debian_linux 8.0 ## Timeline - 2016-11-24: disclosed: Public disclosure on oss-security mailing list - 2016-12-21: patched: Red Hat released security updates for RHEL 6 - 2017-01-05: patched: Red Hat released security updates for RHEL 7 - 2017-01-27: advisory: NVD published the CVE record ## References - [http://rhn.redhat.com/errata/RHSA-2016-2975.html](http://rhn.redhat.com/errata/RHSA-2016-2975.html) - [http://rhn.redhat.com/errata/RHSA-2017-0019.html](http://rhn.redhat.com/errata/RHSA-2017-0019.html) - [http://rhn.redhat.com/errata/RHSA-2017-0020.html](http://rhn.redhat.com/errata/RHSA-2017-0020.html) - [http://www.debian.org/security/2016/dsa-3723](http://www.debian.org/security/2016/dsa-3723) - [http://www.debian.org/security/2016/dsa-3724](http://www.debian.org/security/2016/dsa-3724) - [http://www.openwall.com/lists/oss-security/2016/11/24/2](http://www.openwall.com/lists/oss-security/2016/11/24/2) - [http://www.securityfocus.com/bid/94499](http://www.securityfocus.com/bid/94499) ## Related threats - [GStreamer MXF demuxer off-by-one buffer write](https://junglewise.ai/threats/cve-2026-125707-a-flaw-was-found-in-gstreamer-s-mxf-demuxer-when-an-application) - [GStreamer core buffer value deserialization use-after-free](https://junglewise.ai/threats/cve-2026-125704-a-use-after-free-flaw-was-found-in-gstreamer-core-buffer-value) - [GStreamer integer overflow in AV1 LEB128 parser](https://junglewise.ai/threats/cve-2026-119729-a-flaw-was-found-in-gstreamer-an-integer-overflow-vulnerability) - [GStreamer rtpL16depay heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-111183-gstreamer-rtpl16depay-heap-based-buffer-overflow-remote-code) - [GStreamer rtpsbcdepay use-after-free in RTP SBC payload parsing](https://junglewise.ai/threats/cve-2026-18299-gstreamer-rtpsbcdepay-use-after-free-in-rtp-sbc-payload-parsing)