CVE-2025-3887 — Stack-based Buffer Overflow in Gstreamer
Severity
8.8HIGHNVD
EPSS
1.6%
top 18.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 22
Latest updateJun 5
Description
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior t…
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages2 packages
Also affects: Debian Linux 11.0
🔴Vulnerability Details
4OSV▶
CVE-2025-3887: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability↗2025-05-22
CVEList▶
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability↗2025-05-22
GHSA▶
GHSA-vm2x-3jwq-mv8x: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability↗2025-05-22
📋Vendor Advisories
3Red Hat▶
gstreamer1-plugins-bad-free: mingw-gstreamer1-plugins-bad-free: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability↗2025-05-22
Debian▶
CVE-2025-3887: gst-plugins-bad1.0 - GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution V...↗2025