Skip to main content

Gstreamer CVE-2025-47806

MEDIUM
Stack-based Buffer Overflow (CWE-121)
2025-08-07 cve@mitre.org
Denial Of Service Red Hat Gstreamer Suse
5.6
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-121
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

The CVSS 3.1 score of 5.6 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L reflects a network-accessible vulnerability requiring high attack complexity, with limited confidentiality, integrity, and availability impacts. The EPSS percentile of 22% (0.07% exploitation probability) suggests this vulnerability has not been widely exploited in the wild, placing it in the lower exploitation risk tier. However, this assessment must be balanced against the fact that a proof-of-concept exploit is publicly available via the Atredis Partners advisory, which lowers the barrier to weaponization. The high attack complexity requirement (AC:H) likely reflects the need for crafted input that triggers the specific overflow condition. Under the SSVC framework, this should be considered exploitable (POC exists), potentially automatable (subtitle parsing is deterministic), with limited technical impact (Denial of Service / information leak). For organizations routinely processing untrusted subtitle files from internet sources or user uploads, this poses a moderate practical risk despite the low EPSS; for environments with controlled subtitle sources, risk is minimal.
Exploit ScenarioDerived

An attacker crafts a malicious SubRip subtitle file with an oversized timestamp field designed to overflow the parse_subrip_time stack buffer. When a user or application opens this file in a GStreamer-based media player or application, the overflow is triggered during timestamp parsing, causing the application to crash (Denial of Service). If the overflow is carefully controlled, an attacker might read adjacent stack memory containing sensitive data. Since the attack vector is network-accessible and requires only that the victim open a file or visit a webpage embedding the malicious subtitle, the barrier to exploitation is low despite the AC:H complexity requirement. A proof-of-concept is publicly available, enabling rapid reproduction and potential weaponization in targeted attacks.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 17, 2026

GStreamer's subparse plugin contains a stack-based buffer overflow in the parse_subrip_time function that allows attackers to write data past buffer boundaries, resulting in application crashes and potential information disclosure. Affected versions through 1.26.1 are vulnerable when processing specially crafted subtitle files. A proof-of-concept exploit is publicly available, and while the EPSS score of 0.07% suggests low exploitation probability overall, the availability of working exploit code elevates practical risk for systems processing untrusted subtitle content.

RemediationAI

Upgrade GStreamer to the latest patched version released after 1.26.1 (consult https://gstreamer.freedesktop.org/security/ for the specific version number and release date). For distributions, apply security updates provided by your OS vendor. Until patching is completed, implement the following mitigations: (1) disable the subparse plugin if subtitle support is not required, (2) restrict processing of subtitle files to trusted, internally-generated sources only, (3) run GStreamer-based applications with reduced privileges and in sandboxed environments to limit impact of crashes, and (4) implement file-type validation to reject malformed SubRip files before they reach the parser. Users should avoid opening subtitle files from untrusted internet sources until patches are applied.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GStreamer is a multimedia framework used to construct graphs of media-handling components for applications including video playback, streaming, and format conversion. The vulnerability resides in the subparse plugin, specifically in the parse_subrip_time function, which parses SubRip format subtitle timestamps. This function implements a stack buffer (CWE-121: Stack-based Buffer Overflow) that fails to properly validate input length before writing parsed time values, allowing malicious or malformed SubRip subtitle files to overflow the buffer. The CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:* indicates all versions through at least 1.26.1 are affected. SubRip is a widely-used plain-text subtitle format commonly found in video containers and downloaded from subtitle repositories.

Know when Gstreamer gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.6 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
SUSE MEDIUM
Red Hat 5.6 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

3
Patch released
Apr 06, 2026 - 08:30 nvd
Patch available
PoC Detected
Mar 17, 2026 - 15:52 vuln.today
Public exploit code
CVE Published
Aug 07, 2025 - 20:15 nvd
MEDIUM 5.6

DescriptionCVE.org

In GStreamer through 1.26.1, the subparse plugin's parse_subrip_time function may write data past the bounds of a stack buffer, leading to a crash.

Executive ViewAI

Why It Matters

Organizations using GStreamer should be aware of moderate risk from CVE-2025-47806, a stack-based buffer overflow vulnerability rated CVSS 5.6. Exploitation could cause memory corruption or application crashes. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.

Threat Intelligence Overview

EPSS Score
0.1%
Top 78% exploitable
Exploit
POC
Public exploit code exists
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC Yes
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
No
Human Impact
Low

Priority Score

48
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*

More in Gstreamer

View all
CVE-2016-9636 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9635 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9634 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9808 HIGH POC
7.5 Jan 13

The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
CVE-2019-9928 HIGH
8.8 Apr 24

A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to

CVE-2025-47219 HIGH POC
8.1 Aug 07

A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
CVE-2022-1920 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
CVE-2022-2122 HIGH POC
7.8 Jul 19

A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
CVE-2022-1924 HIGH POC
7.8 Jul 19

A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
CVE-2022-1922 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
CVE-2022-1921 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
CVE-2022-1925 HIGH POC
7.8 Jul 19

A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
SUSE Enterprise Storage 7.1 Fixed
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS Fixed

References

Advisories & patches
ADVISORY https://gstreamer.freedesktop.org/security/ ADVISORY https://vuldb.com/?id.319189 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02020/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02302/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02304/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02472/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02796/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02919/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20507/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20751/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy