Stack-based buffer overflow in gst-plugins-bad - CVE-2025-3887

Vulnerability identifier: #VU107933

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-3887

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in H.265 codec parser when handling malformed streams. A remote unauthenticated attacker can pass specially crafted data to the application, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

gst-plugins-bad
Debian Linux
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Anolis OS
Desktop Applications Module
SUSE Package Hub 15
Basesystem Module
openSUSE Leap
Ubuntu
Fedora
gst-plugins-bad1.0 (Ubuntu package)
libgstmpegts-1_0-0
libgstbadvideo-1_0-0
libgstbadvideo-1_0-0-debuginfo
libgstcodecparsers-1_0-0-debuginfo
libgstbasecamerabinsrc-1_0-0
libgstphotography-1_0-0
gstreamer-plugins-bad-debugsource
libgstphotography-1_0-0-debuginfo
libgstbadbase-1_0-0
libgstbadbase-1_0-0-debuginfo
libgstgl-1_0-0
gstreamer-plugins-bad-debuginfo
libgstmpegts-1_0-0-debuginfo
gstreamer-plugins-bad
libgstbasecamerabinsrc-1_0-0-debuginfo
libgsturidownloader-1_0-0
gstreamer-plugins-bad-devel
libgstadaptivedemux-1_0-0-debuginfo
libgstgl-1_0-0-debuginfo
libgstcodecparsers-1_0-0
libgstbadaudio-1_0-0
libgstadaptivedemux-1_0-0
libgsturidownloader-1_0-0-debuginfo
gstreamer-plugins-bad-lang
libgstbadaudio-1_0-0-debuginfo
gstreamer1-plugins-bad-free (Red Hat package)
libgstwebrtc-1_0-0-debuginfo
typelib-1_0-GstMpegts-1_0
libgstwebrtc-1_0-0
typelib-1_0-GstInsertBin-1_0
libgstplayer-1_0-0
libgstbadaudio-1_0-0-32bit-debuginfo
gstreamer-plugins-bad-chromaprint-32bit-debuginfo
gstreamer-plugins-bad-32bit
libgstmpegts-1_0-0-32bit
libgstcodecparsers-1_0-0-32bit
libgstsctp-1_0-0-32bit
libgsturidownloader-1_0-0-32bit
libgstwayland-1_0-0-32bit-debuginfo
libgstphotography-1_0-0-32bit
libgstbasecamerabinsrc-1_0-0-32bit
libgstadaptivedemux-1_0-0-32bit-debuginfo
libgstmpegts-1_0-0-32bit-debuginfo
libgstplayer-1_0-0-32bit
libgstsctp-1_0-0-32bit-debuginfo
libgstplayer-1_0-0-debuginfo
gstreamer-plugins-bad-doc
libgstisoff-1_0-0
libgstinsertbin-1_0-0
libgstsctp-1_0-0-debuginfo
libgstinsertbin-1_0-0-debuginfo
libgstisoff-1_0-0-debuginfo
typelib-1_0-GstPlayer-1_0
libgstwayland-1_0-0-debuginfo
gstreamer-plugins-bad-chromaprint
gstreamer-plugins-bad-chromaprint-debuginfo
typelib-1_0-GstWebRTC-1_0
libgstsctp-1_0-0
libgstwayland-1_0-0
libgsturidownloader-1_0-0-64bit-debuginfo
libgstsctp-1_0-0-64bit-debuginfo
libgstadaptivedemux-1_0-0-64bit
gstreamer-plugins-bad-64bit
libgstbadaudio-1_0-0-64bit
libgstwebrtc-1_0-0-64bit-debuginfo
libgstcodecparsers-1_0-0-64bit
gstreamer-plugins-bad-chromaprint-64bit-debuginfo
libgstwebrtc-1_0-0-64bit
libgstisoff-1_0-0-64bit-debuginfo
libgstplayer-1_0-0-64bit
libgstinsertbin-1_0-0-64bit
libgstbasecamerabinsrc-1_0-0-32bit-debuginfo
libgstbasecamerabinsrc-1_0-0-64bit-debuginfo
libgstisoff-1_0-0-64bit
libgstphotography-1_0-0-64bit
libgstwayland-1_0-0-64bit-debuginfo
libgstwayland-1_0-0-64bit
libgstadaptivedemux-1_0-0-64bit-debuginfo
libgstplayer-1_0-0-64bit-debuginfo
libgstbasecamerabinsrc-1_0-0-64bit
libgsturidownloader-1_0-0-64bit
libgstsctp-1_0-0-64bit
libgstphotography-1_0-0-64bit-debuginfo
libgstmpegts-1_0-0-64bit-debuginfo
libgstwayland-1_0-0-32bit
gstreamer-plugins-bad-chromaprint-32bit
libgstinsertbin-1_0-0-32bit
libgstinsertbin-1_0-0-32bit-debuginfo
libgstphotography-1_0-0-32bit-debuginfo
libgstisoff-1_0-0-32bit-debuginfo
libgstcodecparsers-1_0-0-32bit-debuginfo
libgsturidownloader-1_0-0-32bit-debuginfo
libgstwebrtc-1_0-0-32bit-debuginfo
libgstadaptivedemux-1_0-0-32bit
libgstbadaudio-1_0-0-32bit
gstreamer-plugins-bad-32bit-debuginfo
libgstbadaudio-1_0-0-64bit-debuginfo
gstreamer-plugins-bad-chromaprint-64bit
libgstinsertbin-1_0-0-64bit-debuginfo
gstreamer-plugins-bad-64bit-debuginfo
libgstmpegts-1_0-0-64bit
libgstcodecparsers-1_0-0-64bit-debuginfo
libgstwebrtc-1_0-0-32bit
libgstplayer-1_0-0-32bit-debuginfo
libgstisoff-1_0-0-32bit
libgstplay-1_0-0
typelib-1_0-GstPlay-1_0
typelib-1_0-GstTranscoder-1_0
libgstcodecs-1_0-0
libgstvulkan-1_0-0-64bit-debuginfo
libgstplay-1_0-0-32bit-debuginfo
libgstva-1_0-0-32bit-debuginfo
libgstplay-1_0-0-32bit
libgstcodecs-1_0-0-32bit
libgstcodecs-1_0-0-64bit-debuginfo
libgstva-1_0-0-64bit-debuginfo
libgstvulkan-1_0-0-64bit
libgstplay-1_0-0-64bit-debuginfo
libgstcodecs-1_0-0-64bit
libgstva-1_0-0-64bit
libgstplay-1_0-0-64bit
typelib-1_0-GstCodecs-1_0
libgstva-1_0-0
libgstplay-1_0-0-debuginfo
libgstcodecs-1_0-0-debuginfo
typelib-1_0-GstBadAudio-1_0
libgstvulkan-1_0-0
libgstva-1_0-0-debuginfo
libgstva-1_0-0-32bit
libgstcodecs-1_0-0-32bit-debuginfo
libgstvulkan-1_0-0-32bit
libgstvulkan-1_0-0-32bit-debuginfo
gstreamer-transcoder-debuginfo
typelib-1_0-GstVulkan-1_0
libgsttranscoder-1_0-0-debuginfo
gstreamer-transcoder-devel
typelib-1_0-GstVulkanWayland-1_0
gstreamer-transcoder
typelib-1_0-GstVulkanXCB-1_0
libgsttranscoder-1_0-0
libgstvulkan-1_0-0-debuginfo
gst-plugins-bad1.0 (Debian package)
libgstwebrtcnice-1_0-0-32bit-debuginfo
typelib-1_0-GstCuda-1_0
typelib-1_0-GstVa-1_0
libgstwebrtcnice-1_0-0
libgstwebrtcnice-1_0-0-debuginfo
libgstcuda-1_0-0-debuginfo
typelib-1_0-CudaGst-1_0
libgstcuda-1_0-0
libgstwebrtcnice-1_0-0-64bit-debuginfo
libgstcuda-1_0-0-64bit
libgstwebrtcnice-1_0-0-64bit
libgstcuda-1_0-0-64bit-debuginfo
libgstcuda-1_0-0-32bit-debuginfo
libgstwebrtcnice-1_0-0-32bit
libgstcuda-1_0-0-32bit
gstreamer1-plugins-bad-free-libs
gstreamer1-plugins-bad-free
gstreamer1-plugins-bad-free-devel
libgstanalytics-1_0-0-32bit
libgsttranscoder-1_0-0-32bit
libgstdxva-1_0-0-32bit
libgstmse-1_0-0-32bit
libgsttranscoder-1_0-0-32bit-debuginfo
libgstdxva-1_0-0-64bit
libgstdxva-1_0-0-64bit-debuginfo
libgsttranscoder-1_0-0-64bit-debuginfo
libgstanalytics-1_0-0-64bit-debuginfo
libgstmse-1_0-0-64bit
libgstmse-1_0-0-64bit-debuginfo
libgsttranscoder-1_0-0-64bit
libgstanalytics-1_0-0-64bit
libgstdxva-1_0-0
typelib-1_0-GstMse-1_0
libgstmse-1_0-0
libgstdxva-1_0-0-debuginfo
libgstanalytics-1_0-0
typelib-1_0-GstDxva-1_0
libgstanalytics-1_0-0-debuginfo
libgstmse-1_0-0-32bit-debuginfo
libgstanalytics-1_0-0-32bit-debuginfo
libgstdxva-1_0-0-32bit-debuginfo
libgstmse-1_0-0-debuginfo
typelib-1_0-GstAnalytics-1_0
gstreamer1-plugins-bad-free-doc
mingw-gstreamer1-plugins-bad-free
gstreamer1-doc
gstreamer1-devel
gstreamer1
IBM App Connect Enterprise

Install updates from vendor's website.

gst-plugins-bad - update to 1.26.1
gst-plugins-bad1.0 (Ubuntu package) - addressed in versions 1.8.3-1ubuntu0.2+esm1, 1.14.5-0ubuntu1~18.04.1+esm1, 1.16.3-0ubuntu1.1+esm1, 1.20.3-0ubuntu1.1+esm2, 1.24.2-1ubuntu4+esm1, 1.24.8-2ubuntu1.1, 1.26.0-1ubuntu2.1
libgstmpegts-1_0-0 - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstbadvideo-1_0-0 - update to 1.8.3-18.18.1
libgstbadvideo-1_0-0-debuginfo - update to 1.8.3-18.18.1
libgstcodecparsers-1_0-0-debuginfo - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstbasecamerabinsrc-1_0-0 - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstphotography-1_0-0 - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer-plugins-bad-debugsource - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstphotography-1_0-0-debuginfo - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstbadbase-1_0-0 - update to 1.8.3-18.18.1
libgstbadbase-1_0-0-debuginfo - update to 1.8.3-18.18.1
libgstgl-1_0-0 - update to 1.8.3-18.18.1
gstreamer-plugins-bad-debuginfo - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstmpegts-1_0-0-debuginfo - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer-plugins-bad - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstbasecamerabinsrc-1_0-0-debuginfo - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgsturidownloader-1_0-0 - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer-plugins-bad-devel - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstadaptivedemux-1_0-0-debuginfo - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstgl-1_0-0-debuginfo - update to 1.8.3-18.18.1
libgstcodecparsers-1_0-0 - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstbadaudio-1_0-0 - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstadaptivedemux-1_0-0 - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgsturidownloader-1_0-0-debuginfo - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer-plugins-bad-lang - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstbadaudio-1_0-0-debuginfo - addressed in versions 1.8.3-18.18.1, 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer1-plugins-bad-free (Red Hat package) - addressed in versions 1.16.1-5.el8_10, 1.22.12-4.el9_6, 1.24.11-2.el10_0
libgstwebrtc-1_0-0-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
typelib-1_0-GstMpegts-1_0 - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstwebrtc-1_0-0 - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
typelib-1_0-GstInsertBin-1_0 - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstplayer-1_0-0 - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstbadaudio-1_0-0-32bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer-plugins-bad-chromaprint-32bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer-plugins-bad-32bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstmpegts-1_0-0-32bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstcodecparsers-1_0-0-32bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstsctp-1_0-0-32bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgsturidownloader-1_0-0-32bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstwayland-1_0-0-32bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstphotography-1_0-0-32bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstbasecamerabinsrc-1_0-0-32bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstadaptivedemux-1_0-0-32bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstmpegts-1_0-0-32bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstplayer-1_0-0-32bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstsctp-1_0-0-32bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstplayer-1_0-0-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer-plugins-bad-doc - update to 1.16.3-150300.9.21.1
libgstisoff-1_0-0 - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstinsertbin-1_0-0 - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstsctp-1_0-0-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstinsertbin-1_0-0-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstisoff-1_0-0-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
typelib-1_0-GstPlayer-1_0 - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstwayland-1_0-0-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer-plugins-bad-chromaprint - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer-plugins-bad-chromaprint-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
typelib-1_0-GstWebRTC-1_0 - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstsctp-1_0-0 - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstwayland-1_0-0 - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgsturidownloader-1_0-0-64bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstsctp-1_0-0-64bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstadaptivedemux-1_0-0-64bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer-plugins-bad-64bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstbadaudio-1_0-0-64bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstwebrtc-1_0-0-64bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstcodecparsers-1_0-0-64bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer-plugins-bad-chromaprint-64bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstwebrtc-1_0-0-64bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstisoff-1_0-0-64bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstplayer-1_0-0-64bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstinsertbin-1_0-0-64bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstbasecamerabinsrc-1_0-0-32bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstbasecamerabinsrc-1_0-0-64bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstisoff-1_0-0-64bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstphotography-1_0-0-64bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstwayland-1_0-0-64bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstwayland-1_0-0-64bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstadaptivedemux-1_0-0-64bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstplayer-1_0-0-64bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstbasecamerabinsrc-1_0-0-64bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgsturidownloader-1_0-0-64bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstsctp-1_0-0-64bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstphotography-1_0-0-64bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstmpegts-1_0-0-64bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstwayland-1_0-0-32bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer-plugins-bad-chromaprint-32bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstinsertbin-1_0-0-32bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstinsertbin-1_0-0-32bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstphotography-1_0-0-32bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstisoff-1_0-0-32bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstcodecparsers-1_0-0-32bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgsturidownloader-1_0-0-32bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstwebrtc-1_0-0-32bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstadaptivedemux-1_0-0-32bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstbadaudio-1_0-0-32bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer-plugins-bad-32bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstbadaudio-1_0-0-64bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer-plugins-bad-chromaprint-64bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstinsertbin-1_0-0-64bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer-plugins-bad-64bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstmpegts-1_0-0-64bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstcodecparsers-1_0-0-64bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstwebrtc-1_0-0-32bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstplayer-1_0-0-32bit-debuginfo - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstisoff-1_0-0-32bit - addressed in versions 1.16.3-150300.9.21.1, 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstplay-1_0-0 - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
typelib-1_0-GstPlay-1_0 - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
typelib-1_0-GstTranscoder-1_0 - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstcodecs-1_0-0 - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstvulkan-1_0-0-64bit-debuginfo - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstplay-1_0-0-32bit-debuginfo - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstva-1_0-0-32bit-debuginfo - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstplay-1_0-0-32bit - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstcodecs-1_0-0-32bit - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstcodecs-1_0-0-64bit-debuginfo - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstva-1_0-0-64bit-debuginfo - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstvulkan-1_0-0-64bit - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstplay-1_0-0-64bit-debuginfo - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstcodecs-1_0-0-64bit - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstva-1_0-0-64bit - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstplay-1_0-0-64bit - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
typelib-1_0-GstCodecs-1_0 - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstva-1_0-0 - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstplay-1_0-0-debuginfo - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstcodecs-1_0-0-debuginfo - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
typelib-1_0-GstBadAudio-1_0 - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstvulkan-1_0-0 - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstva-1_0-0-debuginfo - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstva-1_0-0-32bit - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstcodecs-1_0-0-32bit-debuginfo - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstvulkan-1_0-0-32bit - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstvulkan-1_0-0-32bit-debuginfo - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer-transcoder-debuginfo - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
typelib-1_0-GstVulkan-1_0 - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgsttranscoder-1_0-0-debuginfo - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer-transcoder-devel - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
typelib-1_0-GstVulkanWayland-1_0 - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer-transcoder - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
typelib-1_0-GstVulkanXCB-1_0 - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgsttranscoder-1_0-0 - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstvulkan-1_0-0-debuginfo - addressed in versions 1.20.1-150400.3.26.1, 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gst-plugins-bad1.0 (Debian package) - update to 1.22.0-4+deb12u6
libgstwebrtcnice-1_0-0-32bit-debuginfo - addressed in versions 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
typelib-1_0-GstCuda-1_0 - addressed in versions 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
typelib-1_0-GstVa-1_0 - addressed in versions 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstwebrtcnice-1_0-0 - addressed in versions 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstwebrtcnice-1_0-0-debuginfo - addressed in versions 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstcuda-1_0-0-debuginfo - addressed in versions 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
typelib-1_0-CudaGst-1_0 - addressed in versions 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstcuda-1_0-0 - addressed in versions 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstwebrtcnice-1_0-0-64bit-debuginfo - addressed in versions 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstcuda-1_0-0-64bit - addressed in versions 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstwebrtcnice-1_0-0-64bit - addressed in versions 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstcuda-1_0-0-64bit-debuginfo - addressed in versions 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstcuda-1_0-0-32bit-debuginfo - addressed in versions 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstwebrtcnice-1_0-0-32bit - addressed in versions 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
libgstcuda-1_0-0-32bit - addressed in versions 1.22.0-150500.3.28.1, 1.24.0-150600.4.3.1
gstreamer1-plugins-bad-free-libs - addressed in versions 1.22.12-4.0.1, 1.24.10-2
gstreamer1-plugins-bad-free - addressed in versions 1.22.12-4.0.1, 1.24.10-2
gstreamer1-plugins-bad-free-devel - addressed in versions 1.22.12-4.0.1, 1.24.10-2
libgstanalytics-1_0-0-32bit - update to 1.24.0-150600.4.3.1
libgsttranscoder-1_0-0-32bit - update to 1.24.0-150600.4.3.1
libgstdxva-1_0-0-32bit - update to 1.24.0-150600.4.3.1
libgstmse-1_0-0-32bit - update to 1.24.0-150600.4.3.1
libgsttranscoder-1_0-0-32bit-debuginfo - update to 1.24.0-150600.4.3.1
libgstdxva-1_0-0-64bit - update to 1.24.0-150600.4.3.1
libgstdxva-1_0-0-64bit-debuginfo - update to 1.24.0-150600.4.3.1
libgsttranscoder-1_0-0-64bit-debuginfo - update to 1.24.0-150600.4.3.1
libgstanalytics-1_0-0-64bit-debuginfo - update to 1.24.0-150600.4.3.1
libgstmse-1_0-0-64bit - update to 1.24.0-150600.4.3.1
libgstmse-1_0-0-64bit-debuginfo - update to 1.24.0-150600.4.3.1
libgsttranscoder-1_0-0-64bit - update to 1.24.0-150600.4.3.1
libgstanalytics-1_0-0-64bit - update to 1.24.0-150600.4.3.1
libgstdxva-1_0-0 - update to 1.24.0-150600.4.3.1
typelib-1_0-GstMse-1_0 - update to 1.24.0-150600.4.3.1
libgstmse-1_0-0 - update to 1.24.0-150600.4.3.1
libgstdxva-1_0-0-debuginfo - update to 1.24.0-150600.4.3.1
libgstanalytics-1_0-0 - update to 1.24.0-150600.4.3.1
typelib-1_0-GstDxva-1_0 - update to 1.24.0-150600.4.3.1
libgstanalytics-1_0-0-debuginfo - update to 1.24.0-150600.4.3.1
libgstmse-1_0-0-32bit-debuginfo - update to 1.24.0-150600.4.3.1
libgstanalytics-1_0-0-32bit-debuginfo - update to 1.24.0-150600.4.3.1
libgstdxva-1_0-0-32bit-debuginfo - update to 1.24.0-150600.4.3.1
libgstmse-1_0-0-debuginfo - update to 1.24.0-150600.4.3.1
typelib-1_0-GstAnalytics-1_0 - update to 1.24.0-150600.4.3.1
gstreamer1-plugins-bad-free-doc - update to 1.24.10-2
mingw-gstreamer1-plugins-bad-free - addressed in versions 1.24.10-3.fc41, 1.25.1-3.fc42
gstreamer1-plugins-bad-free - update to 1.24.11-2.fc41
gstreamer1-doc - update to 1.26.1-1
gstreamer1-devel - update to 1.26.1-1
gstreamer1 - update to 1.26.1-1
IBM App Connect Enterprise - addressed in versions 12.0.12, 12.12.0

• https://gstreamer.freedesktop.org/security/sa-2025-0001.html
• https://www.zerodayinitiative.com/advisories/ZDI-25-267/

• Remote code execution in GStreamer gst-plugins-bad
• Fedora 41 update for gstreamer1-plugins-bad-free
• Red Hat Enterprise Linux 9 update for gstreamer1-plugins-bad-free
• Red Hat Enterprise Linux 10 update for gstreamer1-plugins-bad-free
• Red Hat Enterprise Linux 8 update for gstreamer1-plugins-bad-free
• Anolis OS update for gstreamer1-plugins-bad-free
• SUSE update for gstreamer-plugins-bad
• SUSE update for gstreamer-plugins-bad
• SUSE update for gstreamer-plugins-bad
• SUSE update for gstreamer-plugins-bad
• SUSE update for gstreamer-plugins-bad
• Fedora 42 update for mingw-gstreamer1-plugins-bad-free
• Fedora 41 update for mingw-gstreamer1-plugins-bad-free
• Anolis OS update for gstreamer1
• Ubuntu update for gst-plugins-bad1.0
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Debian update for gst-plugins-bad1.0
• Anolis OS update for gstreamer1-plugins-bad-free
• Ubuntu update for gst-plugins-bad1.0