Buffer overflow in gst-plugins-bad and gstreamer - CVE-2025-6663

Vulnerability identifier: #VU111986

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-6663

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the H.266 video bitstream parser. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

gst-plugins-bad
gstreamer
Anolis OS
gstreamer1
gstreamer1-devel
gstreamer1-doc
gstreamer1-plugins-bad-free
gstreamer1-plugins-bad-free-devel
gstreamer1-plugins-bad-free-libs
gstreamer1-plugins-bad-free-doc

Install updates from vendor's website.

gst-plugins-bad - update to 1.26.3
gstreamer - update to 1.26.3
gstreamer1 - update to 1.26.4-1
gstreamer1-devel - update to 1.26.4-1
gstreamer1-doc - update to 1.26.4-1
gstreamer1-plugins-bad-free - update to 1.26.4-1
gstreamer1-plugins-bad-free-devel - update to 1.26.4-1
gstreamer1-plugins-bad-free-libs - update to 1.26.4-1
gstreamer1-plugins-bad-free-doc - update to 1.26.4-1

• https://gstreamer.freedesktop.org/security/sa-2025-0007.html

• Remote code execution in GStreamer
• Anolis OS update for gstreamer1
• Anolis OS update for gstreamer1
• Anolis OS update for gstreamer1-plugins-bad-free
• Anolis OS update for gstreamer1-plugins-bad-free