Skip to main content

Gstreamer CVE-2025-3887

HIGH
Stack-based Buffer Overflow (CWE-121)
2025-05-22 zdi-disclosures@trendmicro.com
RCE Buffer Overflow Debian Red Hat Debian Linux Gstreamer Suse
8.8
CVSS 3.0 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-121
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

The CVSS 3.0 score of 8.8 reflects a high-severity vulnerability with network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:R), with high impacts on confidentiality, integrity, and availability. The EPSS score of 0.61% places it in the 69th percentile, suggesting moderate real-world exploitation probability compared to other CVEs. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public proof-of-concept appears to be available. While the technical severity is high due to the potential for remote code execution, the requirement for user interaction (such as opening a malicious video file) somewhat reduces the immediate threat compared to zero-click vulnerabilities. Organizations using GStreamer should prioritize patching based on their exposure to untrusted media content.
Exploit ScenarioDerived

An attacker crafts a malicious H265/HEVC video file with specially formatted slice headers designed to overflow the stack buffer during parsing. When a user opens this file in a GStreamer-based media player or when a server processes it for transcoding, the overflow occurs, allowing the attacker to execute arbitrary code with the privileges of the media application. Given the low attack complexity and network-based vector, attackers could distribute malicious videos through file-sharing platforms, messaging apps, or compromised websites to target victims at scale.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 17, 2026

A stack-based buffer overflow vulnerability exists in GStreamer's H265 codec parsing functionality that allows remote attackers to execute arbitrary code on affected systems. The vulnerability occurs when processing malformed H265 slice headers, enabling attackers to overflow a fixed-length stack buffer and potentially take control of the application processing the media content. With an EPSS score of 0.61% (69th percentile) and a CVSS score of 8.8, this represents a significant risk for applications using GStreamer for video processing, though it requires user interaction to exploit.

RemediationAI

Apply the security updates provided by your Linux distribution or GStreamer maintainers immediately, with Debian users specifically directed to the advisory at https://lists.debian.org/debian-lts-announce/2025/06/msg00017.html. Until patches can be applied, implement defense-in-depth measures including restricting the processing of untrusted H265/HEVC video content, implementing sandboxing for media processing applications, and monitoring for suspicious process behavior following media file processing. For additional technical details about the vulnerability, refer to the Zero Day Initiative advisory at https://www.zerodayinitiative.com/advisories/ZDI-25-267/.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GStreamer is a widely-used open-source multimedia framework that provides libraries and tools for constructing graphs of media-handling components, commonly used in Linux distributions and multimedia applications. The vulnerability affects GStreamer installations as identified by CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:* and has been confirmed to impact Debian Linux 11.0 (CPE cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*). The root cause is a classic CWE-121 stack-based buffer overflow, where the H265 codec parser fails to properly validate the length of user-supplied data before copying it to a fixed-size buffer on the stack, allowing an attacker to write beyond the buffer boundaries and potentially overwrite return addresses or other critical stack data.

Know when Gstreamer gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch released
Apr 06, 2026 - 02:30 nvd
Patch available
CVE Published
May 22, 2025 - 01:15 nvd
HIGH 8.8

DescriptionCVE.org

GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26596.

Executive ViewAI

Why It Matters

CVE-2025-3887 presents significant security risk, a stack-based buffer overflow vulnerability rated CVSS 8.8. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.

Threat Intelligence Overview

EPSS Score
0.6%
Top 31% exploitable
Exploit
POC
Public exploit code exists
Data Quality
3 sources
Confidence: Low
NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
No
Human Impact
Very High

Priority Score

65
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +44
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

More in Gstreamer

View all
CVE-2016-9636 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9635 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9634 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9808 HIGH POC
7.5 Jan 13

The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
CVE-2019-9928 HIGH
8.8 Apr 24

A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to

CVE-2025-47219 HIGH POC
8.1 Aug 07

A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
CVE-2022-1920 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
CVE-2022-2122 HIGH POC
7.8 Jul 19

A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
CVE-2022-1924 HIGH POC
7.8 Jul 19

A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
CVE-2022-1922 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
CVE-2022-1921 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
CVE-2022-1925 HIGH POC
7.8 Jul 19

A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Enterprise Storage 7.1 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:8183 ADVISORY https://access.redhat.com/errata/RHSA-2025:8184 ADVISORY https://access.redhat.com/errata/RHSA-2025:8201 ADVISORY https://access.redhat.com/errata/RHSA-2025:8976 ADVISORY https://access.redhat.com/errata/RHSA-2025:8977 ADVISORY https://access.redhat.com/errata/RHSA-2025:8978 ADVISORY https://access.redhat.com/errata/RHSA-2025:8979 ADVISORY https://access.redhat.com/errata/RHSA-2025:8980 ADVISORY https://access.redhat.com/errata/RHSA-2025:8981 ADVISORY https://access.redhat.com/errata/RHSA-2025:9056 ADVISORY https://ubuntu.com/security/notices/USN-8205-1 ADVISORY https://vuldb.com/vuln/306782 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:01717/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:01718/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:01725/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:01729/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:01737/ REF https://lists.debian.org/debian-lts-announce/2025/06/msg00017.html REF https://www.zerodayinitiative.com/advisories/ZDI-25-267/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy