CVE-2025-47807
MEDIUMCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
4Description
In GStreamer through 1.26.1, the subparse plugin's subrip_unescape_formatting function may dereference a NULL pointer while parsing a subtitle file, leading to a crash.
Analysis
A NULL pointer dereference vulnerability exists in GStreamer's subparse plugin, specifically in the subrip_unescape_formatting function, which can crash applications when processing maliciously crafted or malformed subtitle files. GStreamer versions through 1.26.1 are affected, and the vulnerability is exploitable through local attack vectors requiring user interaction to open a subtitle file. A public proof-of-concept is available, though the low EPSS score of 0.03% (7th percentile) suggests limited real-world exploitation likelihood despite the availability of exploit code.
Technical Context
GStreamer (cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*) is a multimedia framework that processes various audio and video formats, including subtitle formats like SubRip. The subparse plugin specifically handles subtitle parsing and formatting. The vulnerability is classified as CWE-476 (NULL Pointer Dereference), a memory safety defect where the subrip_unescape_formatting function fails to validate pointer validity before dereferencing it during subtitle file parsing. This occurs when the function encounters unexpected input structures in SubRip subtitle files, causing it to attempt to access memory at a NULL address, resulting in a denial-of-service condition through application crash.
Affected Products
GStreamer through version 1.26.1 is affected, as confirmed by the CPE specification (cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*). All versions up to and including 1.26.1 are vulnerable to this NULL pointer dereference in the subparse plugin. The vulnerability has been disclosed via the GStreamer security advisory available at https://gstreamer.freedesktop.org/security/, and detailed technical information can be found in the Atredis Partners advisory at https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md.
Remediation
Upgrade GStreamer to a version newer than 1.26.1 once a patched release is available from the GStreamer project. Check https://gstreamer.freedesktop.org/security/ and https://gstreamer.freedesktop.org/releases/ for the latest stable release that addresses CVE-2025-47807. As an interim measure before patches are deployed, restrict access to untrusted subtitle files by educating users not to open SubRip files from unknown sources, and consider using application sandboxing or containerization (such as Flatpak for GStreamer-based applications) to limit crash impact to isolated processes. For environments where GStreamer is embedded in servers or automated systems, implement file validation and integrity checks to reject malformed subtitle files before parsing.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today