Stack-based buffer overflow in gstreamer and gst-plugins-base - CVE-2025-47806

Vulnerability identifier: #VU109966

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-47806

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the SubRip subtitle parser. A remote attacker can trick the victim into opening a specially crafted file, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

gstreamer
gst-plugins-base
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
openSUSE Leap
Ubuntu
openEuler
Fedora
gstreamer-0_10-plugins-base-devel
gst-plugins-base1.0 (Ubuntu package)
libgstallocators-1_0-0-debuginfo
gstreamer-plugins-base-lang
libgstfft-1_0-0
libgsttag-1_0-0
libgstrtsp-1_0-0
typelib-1_0-GstApp-1_0
libgstfft-1_0-0-debuginfo
libgstsdp-1_0-0
typelib-1_0-GstTag-1_0
gstreamer-plugins-base-debugsource
libgstgl-1_0-0
libgstrtp-1_0-0-debuginfo
typelib-1_0-GstRtsp-1_0
libgstvideo-1_0-0-debuginfo
typelib-1_0-GstRtp-1_0
libgstpbutils-1_0-0-debuginfo
typelib-1_0-GstSdp-1_0
typelib-1_0-GstAllocators-1_0
libgstvideo-1_0-0
libgstriff-1_0-0
libgstaudio-1_0-0
libgstsdp-1_0-0-debuginfo
libgstapp-1_0-0
typelib-1_0-GstPbutils-1_0
libgstaudio-1_0-0-debuginfo
libgstgl-1_0-0-debuginfo
gstreamer-plugins-base
gstreamer-plugins-base-devel
typelib-1_0-GstAudio-1_0
libgstallocators-1_0-0
libgstrtp-1_0-0
libgstapp-1_0-0-debuginfo
libgsttag-1_0-0-debuginfo
typelib-1_0-GstVideo-1_0
libgstpbutils-1_0-0
typelib-1_0-GstGL-1_0
libgstriff-1_0-0-debuginfo
gstreamer-plugins-base-debuginfo
libgstrtsp-1_0-0-debuginfo
gstreamer1-plugins-base-debuginfo
gstreamer1-plugins-base
gstreamer1-plugins-base-debugsource
gstreamer1-plugins-base-devel
gstreamer1-plugins-base-help
typelib-1_0-GstGLEGL-1_0
libgstvideo-1_0-0-32bit-debuginfo
libgstsdp-1_0-0-32bit-debuginfo
libgstpbutils-1_0-0-32bit-debuginfo
libgstsdp-1_0-0-32bit
libgstrtsp-1_0-0-32bit-debuginfo
libgstpbutils-1_0-0-32bit
libgstvideo-1_0-0-32bit
libgstsdp-1_0-0-64bit
typelib-1_0-GstGLX11-1_0
typelib-1_0-GstGLWayland-1_0
libgsttag-1_0-0-64bit-debuginfo
libgstriff-1_0-0-64bit-debuginfo
gstreamer-plugins-base-devel-64bit
libgstapp-1_0-0-64bit-debuginfo
libgstaudio-1_0-0-64bit
libgstpbutils-1_0-0-64bit-debuginfo
libgstgl-1_0-0-64bit
libgstvideo-1_0-0-64bit-debuginfo
libgstfft-1_0-0-64bit-debuginfo
libgstpbutils-1_0-0-64bit
libgstallocators-1_0-0-64bit
libgstaudio-1_0-0-64bit-debuginfo
libgstapp-1_0-0-64bit
libgstrtp-1_0-0-64bit-debuginfo
libgstgl-1_0-0-64bit-debuginfo
libgstrtsp-1_0-0-64bit-debuginfo
libgstrtp-1_0-0-64bit
gstreamer-plugins-base-64bit
gstreamer-plugins-base-64bit-debuginfo
libgstrtsp-1_0-0-64bit
libgstvideo-1_0-0-64bit
libgstallocators-1_0-0-64bit-debuginfo
libgstriff-1_0-0-64bit
libgstgl-1_0-0-32bit-debuginfo
libgstgl-1_0-0-32bit
libgstallocators-1_0-0-32bit
libgstrtp-1_0-0-32bit
gstreamer-plugins-base-32bit-debuginfo
libgstriff-1_0-0-32bit
libgstfft-1_0-0-32bit-debuginfo
libgsttag-1_0-0-32bit-debuginfo
libgstrtsp-1_0-0-32bit
libgstrtp-1_0-0-32bit-debuginfo
libgstfft-1_0-0-32bit
libgstaudio-1_0-0-32bit
gstreamer-plugins-base-32bit
libgstallocators-1_0-0-32bit-debuginfo
libgstapp-1_0-0-32bit
libgstaudio-1_0-0-32bit-debuginfo
libgstapp-1_0-0-32bit-debuginfo
libgstriff-1_0-0-32bit-debuginfo
gstreamer-plugins-base-devel-32bit
libgsttag-1_0-0-32bit
libgsttag-1_0-0-64bit
libgstsdp-1_0-0-64bit-debuginfo
libgstfft-1_0-0-64bit
mingw-gstreamer1
mingw-gstreamer1-plugins-base
mingw-gstreamer1-plugins-good
mingw-gstreamer1-plugins-bad-free

Install updates from vendor's website.

gstreamer - update to 1.26.2
gst-plugins-base - update to 1.26.2
gstreamer-0_10-plugins-base-devel - update to 0.10.36-18.9.1
gst-plugins-base1.0 (Ubuntu package) - addressed in versions 1.8.3-1ubuntu0.3+esm3, 1.14.5-0ubuntu1~18.04.3+esm2, 1.16.3-0ubuntu1.4+esm1, 1.20.1-1ubuntu0.5, 1.24.2-1ubuntu0.3, 1.26.0-1ubuntu0.1
libgstallocators-1_0-0-debuginfo - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
gstreamer-plugins-base-lang - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstfft-1_0-0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgsttag-1_0-0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstrtsp-1_0-0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
typelib-1_0-GstApp-1_0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstfft-1_0-0-debuginfo - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstsdp-1_0-0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
typelib-1_0-GstTag-1_0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
gstreamer-plugins-base-debugsource - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstgl-1_0-0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstrtp-1_0-0-debuginfo - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
typelib-1_0-GstRtsp-1_0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstvideo-1_0-0-debuginfo - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
typelib-1_0-GstRtp-1_0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstpbutils-1_0-0-debuginfo - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
typelib-1_0-GstSdp-1_0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
typelib-1_0-GstAllocators-1_0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstvideo-1_0-0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstriff-1_0-0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstaudio-1_0-0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstsdp-1_0-0-debuginfo - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstapp-1_0-0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
typelib-1_0-GstPbutils-1_0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstaudio-1_0-0-debuginfo - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstgl-1_0-0-debuginfo - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
gstreamer-plugins-base - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
gstreamer-plugins-base-devel - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
typelib-1_0-GstAudio-1_0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstallocators-1_0-0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstrtp-1_0-0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstapp-1_0-0-debuginfo - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgsttag-1_0-0-debuginfo - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
typelib-1_0-GstVideo-1_0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstpbutils-1_0-0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
typelib-1_0-GstGL-1_0 - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstriff-1_0-0-debuginfo - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
gstreamer-plugins-base-debuginfo - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
libgstrtsp-1_0-0-debuginfo - addressed in versions 1.16.3-150200.4.19.1, 1.22.0-150500.3.14.1
gstreamer1-plugins-base-debuginfo - update to 1.18.4-9
gstreamer1-plugins-base - update to 1.18.4-9
gstreamer1-plugins-base-debugsource - update to 1.18.4-9
gstreamer1-plugins-base-devel - update to 1.18.4-9
gstreamer1-plugins-base-help - update to 1.18.4-9
typelib-1_0-GstGLEGL-1_0 - update to 1.22.0-150500.3.14.1
libgstvideo-1_0-0-32bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstsdp-1_0-0-32bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstpbutils-1_0-0-32bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstsdp-1_0-0-32bit - update to 1.22.0-150500.3.14.1
libgstrtsp-1_0-0-32bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstpbutils-1_0-0-32bit - update to 1.22.0-150500.3.14.1
libgstvideo-1_0-0-32bit - update to 1.22.0-150500.3.14.1
libgstsdp-1_0-0-64bit - update to 1.22.0-150500.3.14.1
typelib-1_0-GstGLX11-1_0 - update to 1.22.0-150500.3.14.1
typelib-1_0-GstGLWayland-1_0 - update to 1.22.0-150500.3.14.1
libgsttag-1_0-0-64bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstriff-1_0-0-64bit-debuginfo - update to 1.22.0-150500.3.14.1
gstreamer-plugins-base-devel-64bit - update to 1.22.0-150500.3.14.1
libgstapp-1_0-0-64bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstaudio-1_0-0-64bit - update to 1.22.0-150500.3.14.1
libgstpbutils-1_0-0-64bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstgl-1_0-0-64bit - update to 1.22.0-150500.3.14.1
libgstvideo-1_0-0-64bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstfft-1_0-0-64bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstpbutils-1_0-0-64bit - update to 1.22.0-150500.3.14.1
libgstallocators-1_0-0-64bit - update to 1.22.0-150500.3.14.1
libgstaudio-1_0-0-64bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstapp-1_0-0-64bit - update to 1.22.0-150500.3.14.1
libgstrtp-1_0-0-64bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstgl-1_0-0-64bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstrtsp-1_0-0-64bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstrtp-1_0-0-64bit - update to 1.22.0-150500.3.14.1
gstreamer-plugins-base-64bit - update to 1.22.0-150500.3.14.1
gstreamer-plugins-base-64bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstrtsp-1_0-0-64bit - update to 1.22.0-150500.3.14.1
libgstvideo-1_0-0-64bit - update to 1.22.0-150500.3.14.1
libgstallocators-1_0-0-64bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstriff-1_0-0-64bit - update to 1.22.0-150500.3.14.1
libgstgl-1_0-0-32bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstgl-1_0-0-32bit - update to 1.22.0-150500.3.14.1
libgstallocators-1_0-0-32bit - update to 1.22.0-150500.3.14.1
libgstrtp-1_0-0-32bit - update to 1.22.0-150500.3.14.1
gstreamer-plugins-base-32bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstriff-1_0-0-32bit - update to 1.22.0-150500.3.14.1
libgstfft-1_0-0-32bit-debuginfo - update to 1.22.0-150500.3.14.1
libgsttag-1_0-0-32bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstrtsp-1_0-0-32bit - update to 1.22.0-150500.3.14.1
libgstrtp-1_0-0-32bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstfft-1_0-0-32bit - update to 1.22.0-150500.3.14.1
libgstaudio-1_0-0-32bit - update to 1.22.0-150500.3.14.1
gstreamer-plugins-base-32bit - update to 1.22.0-150500.3.14.1
libgstallocators-1_0-0-32bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstapp-1_0-0-32bit - update to 1.22.0-150500.3.14.1
libgstaudio-1_0-0-32bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstapp-1_0-0-32bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstriff-1_0-0-32bit-debuginfo - update to 1.22.0-150500.3.14.1
gstreamer-plugins-base-devel-32bit - update to 1.22.0-150500.3.14.1
libgsttag-1_0-0-32bit - update to 1.22.0-150500.3.14.1
libgsttag-1_0-0-64bit - update to 1.22.0-150500.3.14.1
libgstsdp-1_0-0-64bit-debuginfo - update to 1.22.0-150500.3.14.1
libgstfft-1_0-0-64bit - update to 1.22.0-150500.3.14.1
mingw-gstreamer1 - addressed in versions 1.26.3-1.fc41, 1.26.3-1.fc42
mingw-gstreamer1-plugins-base - addressed in versions 1.26.3-1.fc41, 1.26.3-1.fc42
mingw-gstreamer1-plugins-good - addressed in versions 1.26.3-1.fc41, 1.26.3-1.fc42
mingw-gstreamer1-plugins-bad-free - addressed in versions 1.26.3-4.fc41, 1.26.3-4.fc42

• https://gstreamer.freedesktop.org/security/sa-2025-0006.html

• Multiple vulnerabilities in GStreamer
• openEuler update for gstreamer1-plugins-base
• SUSE update for gstreamer-plugins-base
• Fedora 41 update for mingw-gstreamer1, mingw-gstreamer1-plugins-bad-free, mingw-gstreamer1-plugins-base, mingw-gstreamer1-plugins-good
• Fedora 42 update for mingw-gstreamer1, mingw-gstreamer1-plugins-bad-free, mingw-gstreamer1-plugins-base, mingw-gstreamer1-plugins-good
• SUSE update for gstreamer-plugins-base
• SUSE update for gstreamer-plugins-base
• SUSE update for gstreamer-0_10-plugins-base
• Ubuntu update for gst-plugins-base1.0
• Ubuntu update for gst-plugins-base1.0