Gstreamer CVE-2025-47183

This vulnerability presents a nuanced risk profile where CVSS and EPSS metrics tell different stories. The CVSS 3.1 score of 6.6 reflects a medium-to-high severity due to high confidentiality impact (information disclosure from heap memory) and high availability impact (crash potential), combined with low attack complexity and local attack vector requiring user interaction. However, the EPSS score of 0.02% (4th percentile) suggests this is not being actively exploited in the wild at scale. The presence of publicly available proof-of-concept code from Atredis Partners elevates practical risk for targeted attacks. The attack vector (local, UI required) and privilege level (low/user) limit opportunistic exploitation—an attacker must either have local system access or trick a user into opening a crafted MP4 file through a media player or editing tool. The information disclosure aspect is serious for applications handling sensitive media or running with elevated privileges. Given the lack of CISA KEV listing indication, active exploitation in the wild appears limited, but the combination of public POC + user interaction attack surface means organizations should prioritize patching within standard maintenance cycles rather than treating this as an emergency zero-day.

An attacker crafts a malicious MP4 file with specially formatted atom headers that cause the qtdemux_parse_tree function to calculate incorrect buffer boundaries. When a user opens this file in a GStreamer-based media player (e.g., GNOME Videos) or application, the parser reads beyond the allocated heap buffer, leaking sensitive data from adjacent memory regions (credentials, encryption keys, or other application data) to the attacker via information disclosure, or triggering a heap corruption that crashes the application. The public POC from Atredis Partners demonstrates this reliably, making it viable for targeted attacks against specific users or systems, particularly in environments where media file handling is common.