Gstreamer
CVE-2022-1925
HIGH
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the matroskaparse element has no size checks.
AnalysisAI
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska_decompress_data function when processing MKV files with HEADERSTRIP decompression. While the matroskaparse element lacks proper size checks making it vulnerable, the more commonly used matroskademux element has restrictions that prevent exploitation. A proof-of-concept exploit is publicly available, though the EPSS score indicates a relatively low (4%) probability of real-world exploitation.
Technical ContextAI
GStreamer is a multimedia framework used for creating streaming media applications, with the affected versions identified through CPE as all versions prior to the fix (cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*). The vulnerability stems from a classic heap-based buffer overflow (CWE-122) where integer overflow during decompression calculations leads to undersized buffer allocation. The matroskaparse element processes Matroska/MKV container files and specifically fails to validate chunk sizes during HEADERSTRIP decompression, while the matroskademux element (used for actual playback) includes protective size restrictions.
RemediationAI
Apply the security updates provided by your distribution immediately - Debian users should install DSA-5204 updates, while other distributions should check for GStreamer updates that address CVE-2022-1925. For systems that cannot be immediately patched, consider restricting access to untrusted MKV files and disabling matroskaparse element usage where possible. Monitor the upstream GitLab issue at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225 for additional patches and verify updates are applied through your package manager.
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
An integer overflow vulnerability in GStreamer's matroska demuxer can cause denial of service through segmentation fault
An out-of-bounds write vulnerability exists in GStreamer's SSA subtitle parser (gstssaparse.c) that occurs when malforme
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today