Skip to main content

Gstreamer CVE-2025-2759

HIGH
Incorrect Permission Assignment for Critical Resource (CWE-732)
2025-05-22 zdi-disclosures@trendmicro.com
Privilege Escalation RCE Gstreamer Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
Analysis Generated
Mar 17, 2026 - 20:45 vuln.today
CVE Published
May 22, 2025 - 01:15 nvd
HIGH 7.8

DescriptionCVE.org

GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of GStreamer. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the product installer. The issue results from incorrect permissions on folders. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25448.

AnalysisAI

A local privilege escalation vulnerability in GStreamer's installer allows attackers with low-privileged access to escalate to higher privileges due to incorrect folder permissions. The vulnerability affects all versions of GStreamer and enables arbitrary code execution in the context of a target user. With a low EPSS score of 0.01% and no KEV listing, this vulnerability has limited evidence of active exploitation in the wild.

Technical ContextAI

GStreamer is an open-source multimedia framework used for creating streaming media applications, affected across all versions according to the CPE identifier cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The vulnerability stems from CWE-732 (Incorrect Permission Assignment for Critical Resource), where the product installer sets overly permissive access rights on folders during installation. This permission misconfiguration allows lower-privileged processes to modify or replace files that will be executed with higher privileges, creating a pathway for privilege escalation.

RemediationAI

Update to the latest version of GStreamer once a patched version is released by the GStreamer project. Until an official patch is available, manually review and correct folder permissions created by the GStreamer installer, ensuring that low-privileged users cannot write to directories containing executables or libraries loaded by higher-privileged processes. Monitor the Zero Day Initiative advisory at https://www.zerodayinitiative.com/advisories/ZDI-25-268/ for patch availability announcements.

More in Gstreamer

View all
CVE-2016-9636 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9635 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9634 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9808 HIGH POC
7.5 Jan 13

The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
CVE-2019-9928 HIGH
8.8 Apr 24

A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to

CVE-2022-1920 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
CVE-2022-2122 HIGH POC
7.8 Jul 19

A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
CVE-2022-1924 HIGH POC
7.8 Jul 19

A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
CVE-2022-1922 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
CVE-2022-1921 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
CVE-2022-1925 HIGH POC
7.8 Jul 19

A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
CVE-2022-1923 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's matroska demuxer can cause denial of service through segmentation fault

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

View all
CVE-2017-9462 HIGH POC
8.8
CVE-2017-3006 HIGH POC
8.8
CVE-2017-9602 CRITICAL POC
9.8
CVE-2022-22960 HIGH POC
7.8
CVE-2021-38085 HIGH POC
7.8
CVE-2021-35449 HIGH POC
7.8
CVE-2020-11855 HIGH POC
7.8
CVE-2020-10883 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2016-10372 CRITICAL POC
9.8
CVE-2014-9583 CRITICAL POC
10.0
CVE-2012-0297 CRITICAL POC
10.0

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.2 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed

Share

CVE-2025-2759 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy