Gstreamer CVE-2025-2759

HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2025-05-22 zdi-disclosures@trendmicro.com

Privilege Escalation RCE Gstreamer Suse

7.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-732 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V13 - Configuration Permission assignment review
Impact	While the CVSS score of 7.8 indicates high severity, the real-world risk appears moderate based on multiple signals. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms this requires local access with low privileges and no user interaction, making it a post-compromise vulnerability. The extremely low EPSS score of 0.01% (3rd percentile) suggests minimal exploitation activity in the wild. The vulnerability is not listed in CISA's KEV catalog, indicating no confirmed active exploitation. Without evidence of public exploits or automated attack tools, this represents a legitimate but non-critical risk that should be addressed during regular patching cycles rather than emergency response.
Exploit ScenarioDerived	An attacker who has already compromised a low-privileged user account on a Windows system with GStreamer installed could exploit the incorrect folder permissions to place malicious files in GStreamer directories. When a higher-privileged user or process executes GStreamer components, the attacker's code would run with elevated privileges, achieving privilege escalation. No public proof-of-concept exists, but exploitation requires only basic file system manipulation skills.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Mar 17, 2026

A local privilege escalation vulnerability in GStreamer's installer allows attackers with low-privileged access to escalate to higher privileges due to incorrect folder permissions. The vulnerability affects all versions of GStreamer and enables arbitrary code execution in the context of a target user. With a low EPSS score of 0.01% and no KEV listing, this vulnerability has limited evidence of active exploitation in the wild.

RemediationAI

Update to the latest version of GStreamer once a patched version is released by the GStreamer project. Until an official patch is available, manually review and correct folder permissions created by the GStreamer installer, ensuring that low-privileged users cannot write to directories containing executables or libraries loaded by higher-privileged processes. Monitor the Zero Day Initiative advisory at https://www.zerodayinitiative.com/advisories/ZDI-25-268/ for patch availability announcements.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

GStreamer is an open-source multimedia framework used for creating streaming media applications, affected across all versions according to the CPE identifier cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability stems from CWE-732 (Incorrect Permission Assignment for Critical Resource), where the product installer sets overly permissive access rights on folders during installation. This permission misconfiguration allows lower-privileged processes to modify or replace files that will be executed with higher privileges, creating a pathway for privilege escalation.

Know when Gstreamer gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

2

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

May 22, 2025 - 01:15 nvd

HIGH 7.8

DescriptionCVE.org

GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of GStreamer. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the product installer. The issue results from incorrect permissions on folders. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25448.

Executive ViewAI

Why It Matters

CVE-2025-2759 presents notable security risk, a incorrect permissions vulnerability rated CVSS 7.8. Attackers could escalate their privileges to gain elevated access beyond their authorized level. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: High

Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score

0.0%

Top 97% exploitable

Data Quality

4 sources

Confidence: Medium

CVE.org

EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

No

Human Impact

High

Priority Score

39

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*

More in Gstreamer

View all

CVE-2016-9636 CRITICAL Emergency POC

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9635 CRITICAL Emergency POC

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9634 CRITICAL Emergency POC

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9808 HIGH This Week POC

The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an

CVE-2019-9928 HIGH Act Now

A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to

CVE-2025-47219 HIGH This Week POC

A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun

CVE-2022-1920 HIGH This Week POC

An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption

CVE-2022-2122 HIGH This Week POC

A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o

CVE-2022-1924 HIGH This Week POC

A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia

CVE-2022-1922 HIGH This Week POC

An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory

CVE-2022-1921 HIGH This Week POC

An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par

CVE-2022-1925 HIGH This Week POC

A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

View all

CVE-2017-9462 HIGH POC

CVE-2017-3006 HIGH POC

CVE-2017-9602 CRITICAL POC

CVE-2022-22960 HIGH POC

CVE-2021-38085 HIGH POC

CVE-2021-35449 HIGH POC

CVE-2020-11855 HIGH POC

CVE-2020-10883 HIGH POC

Same technique Privilege Escalation

View all

CVE-2024-0012 CRITICAL POC

CVE-2025-47812 CRITICAL POC

CVE-2013-0422 CRITICAL POC

CVE-2013-0632 CRITICAL POC

CVE-2024-9474 MEDIUM POC

CVE-2017-5689 CRITICAL POC

CVE-2021-20021 CRITICAL POC

CVE-2017-12635 CRITICAL POC

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed
SUSE Linux Enterprise Micro 5.2	Fixed
SUSE Linux Enterprise Micro 5.3	Fixed
SUSE Linux Enterprise Micro 5.4	Fixed

References

Advisories & patches

REF https://www.zerodayinitiative.com/advisories/ZDI-25-268/

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy