Gstreamer CVE-2025-47219

HIGH

Out-of-bounds Read (CWE-125)

2025-08-07 cve@mitre.org

Buffer Overflow Information Disclosure Gstreamer

8.1

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-125 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	Despite the high CVSS score of 8.1, the real-world risk appears moderate based on multiple factors. The CVSS vector shows network-based attacks with high complexity and no authentication required (AV:N/AC:H/PR:N/UI:N), suggesting exploitation is non-trivial. The EPSS score of 0.09% (26th percentile) indicates low likelihood of active exploitation. While a public POC exists at the Atredis Partners advisory, the vulnerability is not listed in CISA's KEV catalog, suggesting no confirmed in-the-wild exploitation. The high CVSS score appears driven by the theoretical possibility of chaining this information disclosure with other vulnerabilities rather than direct impact.
Exploit ScenarioDerived	An attacker could craft a malicious MP4 file and serve it through a web application or file-sharing service to trigger the vulnerability when processed by a GStreamer-based media player or transcoding service. Due to the high attack complexity noted in the CVSS score, successful exploitation would likely require precise heap layout manipulation and possibly chaining with other vulnerabilities to achieve meaningful impact beyond information disclosure. A proof-of-concept demonstrating the heap over-read is publicly available in the Atredis Partners advisory.

This Week Schedule remediation this week. Why: Active threat signals + CRITICAL/HIGH severity.

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Mar 17, 2026

A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boundaries when parsing specially crafted MP4 files. This affects GStreamer through version 1.26.1 and can lead to information disclosure of heap memory contents. A public proof-of-concept exploit is available, though the EPSS score of 0.09% suggests relatively low exploitation likelihood in the wild.

RemediationAI

Upgrade GStreamer to a version newer than 1.26.1 once a patched release becomes available from the vendor. Monitor the official GStreamer security page at https://gstreamer.freedesktop.org/security/ for patch announcements. As a temporary mitigation, consider restricting processing of untrusted MP4 files or implementing input validation before passing files to GStreamer-based applications. Organizations using GStreamer in production should assess which applications depend on the isomp4 plugin and prioritize patching based on exposure to untrusted media files.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

GStreamer is a popular open-source multimedia framework used across Linux distributions and applications for audio/video processing. The vulnerability occurs in the qtdemux_parse_trak function within the isomp4 plugin, which is responsible for parsing MP4/MOV container formats. This is a classic CWE-125 out-of-bounds read vulnerability where the parser fails to properly validate buffer boundaries when processing track atom data in MP4 files. The affected product is identified as cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:* for versions up to and including 1.26.1.

Know when Gstreamer gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE HIGH

Red Hat 5.6 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

3

Patch released

Apr 06, 2026 - 08:30 nvd

Patch available

PoC Detected

Mar 17, 2026 - 15:52 vuln.today

Public exploit code

CVE Published

Aug 07, 2025 - 20:15 nvd

HIGH 8.1

DescriptionCVE.org

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.

Executive ViewAI

Why It Matters

Organizations using GStreamer face notable risk from CVE-2025-47219, a out-of-bounds read vulnerability rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. Proof-of-concept code is publicly available, increasing the risk of exploitation. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: High

Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score

0.1%

Top 74% exploitable

Threat Intel

1

1 source

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

CVE.org

EPSS CISA Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available Yes

Active threat Yes

Deciding rule

Active threat signals + CRITICAL/HIGH severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

No

Human Impact

High

Priority Score

70

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +40

PoC: +20

Weaponized: 0

Threat intel: +10

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*

More in Gstreamer

View all

CVE-2016-9636 CRITICAL Emergency POC

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9635 CRITICAL Emergency POC

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9634 CRITICAL Emergency POC

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9808 HIGH This Week POC

The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an

CVE-2019-9928 HIGH Act Now

A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to

CVE-2022-1920 HIGH This Week POC

An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption

CVE-2022-2122 HIGH This Week POC

A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o

CVE-2022-1924 HIGH This Week POC

A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia

CVE-2022-1922 HIGH This Week POC

An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory

CVE-2022-1921 HIGH This Week POC

An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par

CVE-2022-1925 HIGH This Week POC

A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska

CVE-2022-1923 HIGH This Week POC

An integer overflow vulnerability in GStreamer's matroska demuxer can cause denial of service through segmentation fault

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

CVE-2016-5198 HIGH POC

CVE-2025-5777 CRITICAL POC

CVE-2016-1646 HIGH POC

CVE-2017-5030 HIGH POC

CVE-2016-4523 HIGH

CVE-2024-48456 HIGH POC

CVE-2024-48457 HIGH POC

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2020-0796 CRITICAL POC

CVE-2019-11043 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2012-1889 HIGH POC

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP6	Fixed

Threat IntelligenceMISP

CISA Advisories

ICSA-26-134-10

Sources: CISA (public domain)

References

Advisories & patches

ADVISORY https://gstreamer.freedesktop.org/security/ ADVISORY https://vuldb.com/?id.319187 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02053/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02058/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02347/ REF https://cert-portal.siemens.com/productcert/html/ssa-032379.html

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy