CVE-2025-3887
published 2025-05-22CVE-2025-3887: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary…
PriorityP258high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
0.73%
50.3th percentile
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26596.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | gst-plugins-bad1.0 | < gst-plugins-bad1.0 1.22.0-4+deb12u6 (bookworm) | gst-plugins-bad1.0 1.22.0-4+deb12u6 (bookworm) |
| gstreamer | gstreamer | — | — |
| gstreamer | gstreamer | >= 1.0.0 < 1.26.1 | 1.26.1 |
| ubuntu | gst-plugins-bad1.0 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability exists within the parsing of H265 slice headers in GStreamer's H265 codec plugin (gstreamer1-plugins-bad / gstreamer-plugins-bad). Monitor for processing of malformed H265/HEVC media files, particularly those with oversized slice header data that could trigger a stack-based buffer overflow. ↗
- →The affected component is the GStreamer Bad Plugins H265 codec plugin. On Red Hat/Fedora systems, the vulnerable package is mingw-gstreamer1-plugins-bad-free (RHEL 8 affected) and gstreamer1-plugins-bad-free (RHEL 7 not affected). Audit installed versions and flag unpatched deployments. ↗
- →Attack vectors vary by implementation but require interaction with the GStreamer library. Any application that uses GStreamer to parse untrusted H265/HEVC media content (e.g., video players, media servers, streaming pipelines) is a potential attack surface. ↗
- →Successful exploitation results in arbitrary code execution in the context of the current process. Correlate unexpected crashes or code execution events in processes that invoke GStreamer H265 decoding pipelines with suspicious or externally-sourced media input. ↗
- ·Red Hat notes that stack protection mitigations (FORTIFY_SOURCE, PIE, Stack Smashing Protection) are in place on RHEL builds, which may reduce exploitability. Severity assessments should account for whether these mitigations are active in the target environment. ↗
- ·On Debian, fixed versions are available: bookworm (1.22.0-4+deb12u6), bullseye (1.18.4-3+deb11u5), forky/sid/trixie (1.26.1-1). Systems running older versions remain vulnerable. ↗
- ·RHEL 7 with gstreamer1-plugins-bad-free is listed as Not Affected; only RHEL 8 with mingw-gstreamer1-plugins-bad-free is confirmed Affected. Scope assessments should differentiate between these package variants. ↗
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GStreamer Bad Plugins vulnerabilities
vendor_ubuntu·2026-04-23·CVSS 8.8
CVE-2023-40475 [HIGH] GStreamer Bad Plugins vulnerabilities
Title: GStreamer Bad Plugins vulnerabilities
Summary: Several security issues were fixed in GStreamer Bad Plugins.
It was discovered that multiple plugins in GStreamer contained arithmetic
overflows. An attacker could possibly use this issue to cause applications
using the plugins to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2023-37329, CVE-2023-40474, CVE-2023-40475,
CVE-2023-40476)
It was discovered that the MXF demuxer plugin in GStreamer did not
properly manage memory. An attacker could possibly use this issue to cause
applications using the plugin to crash, resulting in a denial of service,
or possibly execute arbitrary code. (CVE-2023-44446)
It was discovered that the H265 codec plugin in GStreamer could be made
to write out of bounds. An a
Ubuntu
GStreamer Bad Plugins vulnerabilities
vendor_ubuntu·2025-06-05·CVSS 8.8
CVE-2023-50186 [HIGH] GStreamer Bad Plugins vulnerabilities
Title: GStreamer Bad Plugins vulnerabilities
Summary: Several security issues were fixed in GStreamer Bad Plugins.
It was discovered that the AV1 codec plugin in GStreamer could be made
to write out of bounds. An attacker could possibly use this issue to
cause applications using the plugin to crash, resulting in a denial of
service, or possibly execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS. (CVE-2023-50186, CVE-2024-0444)
It was discovered that the H265 codec plugin in GStreamer could be made
to write out of bounds. An attacker could possibly use this issue to
cause applications using the plugin to crash, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2025-3887)
Instructions: In general, a standard system update will make all the necessar
Red Hat
gstreamer1-plugins-bad-free: mingw-gstreamer1-plugins-bad-free: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
vendor_redhat·2025-05-22·CVSS 8.8
CVE-2025-3887 [HIGH] CWE-121 gstreamer1-plugins-bad-free: mingw-gstreamer1-plugins-bad-free: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
gstreamer1-plugins-bad-free: mingw-gstreamer1-plugins-bad-free: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current pr
Debian
CVE-2025-3887: gst-plugins-bad1.0 - GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution V...
vendor_debian·2025·CVSS 8.8
CVE-2025-3887 [HIGH] CVE-2025-3887: gst-plugins-bad1.0 - GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution V...
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26596.
Scope: local
bookworm: resolved (fixed in 1.22.0-4+deb12u6)
bullseye: resolved (fixed in 1.18.4-3+deb11u5)
forky: resolved (fixed in
OSV
gst-plugins-bad1.0 vulnerabilities
osv·2025-06-05·CVSS 8.8
CVE-2023-50186 [HIGH] gst-plugins-bad1.0 vulnerabilities
gst-plugins-bad1.0 vulnerabilities
It was discovered that the AV1 codec plugin in GStreamer could be made
to write out of bounds. An attacker could possibly use this issue to
cause applications using the plugin to crash, resulting in a denial of
service, or possibly execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS. (CVE-2023-50186, CVE-2024-0444)
It was discovered that the H265 codec plugin in GStreamer could be made
to write out of bounds. An attacker could possibly use this issue to
cause applications using the plugin to crash, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2025-3887)
OSV
CVE-2025-3887: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
osv·2025-05-22·CVSS 8.8
CVE-2025-3887 [HIGH] CVE-2025-3887: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26596.
GHSA
GHSA-vm2x-3jwq-mv8x: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
ghsa_unreviewed·2025-05-22
CVE-2025-3887 [HIGH] CWE-121 GHSA-vm2x-3jwq-mv8x: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26596.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-05-22
Published