CVE-2025-3887
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26596.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26596.
- Record
CVE-2025-3887- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-02
EUVDEUVD-2025-16092
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26596.
- Record
EUVD-2025-16092- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vm2x-3jwq-mv8x
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability....
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26596.
- Record
GHSA-vm2x-3jwq-mv8x- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-121, CWE-787
- Updated
- 2026-11-02
NVD
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26596.
- Record
CVE-2025-3887- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-121, CWE-787
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-3887
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26596.
- Record
ALPINE-CVE-2025-3887- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26596.
- Record
CVE-2025-3887- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-02
Show 27 moreShow less
OSVDEBIAN-CVE-2025-3887
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26596.
- Record
DEBIAN-CVE-2025-3887- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:8183
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2025:8183- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:8184
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2025:8184- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:8201
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2025:8201- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:8976
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2025:8976- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:8977
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2025:8977- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:8978
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2025:8978- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:8979
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2025:8979- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:8980
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2025:8980- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:8981
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2025:8981- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2025:9056
Red Hat Security Advisory: gstreamer1-plugins-bad-free security update
- Record
RHSA-2025:9056- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2025:8183
Important: gstreamer1-plugins-bad-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.
Security Fix(es):
- GStreamer: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-3887)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2025:8183- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2025:8184
Important: gstreamer1-plugins-bad-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.
Security Fix(es):
- GStreamer: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-3887)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2025:8184- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2025:8201
Important: gstreamer1-plugins-bad-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.
Security Fix(es):
- GStreamer: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-3887)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2025:8201- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-3887
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26596.
- Record
UBUNTU-CVE-2025-3887- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2025:8183 No score
Important: gstreamer1-plugins-bad-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.
Security Fix(es):
- GStreamer: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-3887)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2025:8183- Updated
- 2026-11-02
OSVALSA-2025:8184 No score
Important: gstreamer1-plugins-bad-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.
Security Fix(es):
- GStreamer: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-3887)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2025:8184- Updated
- 2026-11-02
OSVALSA-2025:8201 No score
Important: gstreamer1-plugins-bad-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.
Security Fix(es):
- GStreamer: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-3887)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2025:8201- Updated
- 2026-11-02
OSVCLSA-2025-1753729945 No score
gstreamer1-plugins-bad-free: Fix of CVE-2025-3887
- CVE-2025-3887: fix H265 slice header parsing to validate num_long_term_pics and prevent stack overflow
- Record
CLSA-2025-1753729945- Updated
- 2026-11-02
OSVMGASA-2025-0264 No score
Updated gstreamer1.0-plugins-bad packages fix security vulnerability
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. (CVE-2025-3887)
- Record
MGASA-2025-0264- Updated
- 2026-11-02
OSVROOT-OS-UBUNTU-2404-CVE-2025-3887 No score
CVE-2025-3887 in gst-plugins-bad1.0 - Patched by Root
Root has patched CVE-2025-3887 in the gst-plugins-bad1.0 package for Root:Ubuntu:24.04. Multiple fixed versions available.
- Record
ROOT-OS-UBUNTU-2404-CVE-2025-3887- Updated
- 2026-11-02
OSVSUSE-SU-2025:01717-1 No score
Security update for gstreamer-plugins-bad
This update for gstreamer-plugins-bad fixes the following issues:
- CVE-2025-3887: Fixed possible RCE vulnerability via buffer overflow in H265 Codec Parsing (bsc#1242809).
- Record
SUSE-SU-2025:01717-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:01718-1 No score
Security update for gstreamer-plugins-bad
This update for gstreamer-plugins-bad fixes the following issues:
- CVE-2025-3887: Fixed possible RCE vulnerability via buffer overflow in H265 Codec Parsing (bsc#1242809).
- Record
SUSE-SU-2025:01718-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:01725-1 No score
Security update for gstreamer-plugins-bad
This update for gstreamer-plugins-bad fixes the following issues:
- CVE-2025-3887: Fixed possible RCE vulnerability via buffer overflow in H265 Codec Parsing (bsc#1242809).
- Record
SUSE-SU-2025:01725-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:01729-1 No score
Security update for gstreamer-plugins-bad
This update for gstreamer-plugins-bad fixes the following issues:
- CVE-2025-3887: Fixed possible RCE vulnerability via buffer overflow in H265 Codec Parsing (bsc#1242809).
- Record
SUSE-SU-2025:01729-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:01737-1 No score
Security update for gstreamer-plugins-bad
This update for gstreamer-plugins-bad fixes the following issues:
- CVE-2025-3887: Fixed possible RCE vulnerability via buffer overflow in H265 Codec Parsing (bsc#1242809).
- Record
SUSE-SU-2025:01737-1- Updated
- 2026-11-02
OSVUSN-7558-1 No score
gst-plugins-bad1.0 vulnerabilities
It was discovered that the AV1 codec plugin in GStreamer could be made to write out of bounds. An attacker could possibly use this issue to cause applications using the plugin to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-50186, CVE-2024-0444)
It was discovered that the H265 codec plugin in GStreamer could be made to write out of bounds. An attacker could possibly use this issue to cause applications using the plugin to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-3887)
- Record
USN-7558-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gst-plugins-badAlpine:v3.22 |
before 1.26.1-r0 | 1.26.1-r0 |
gst-plugins-badAlpine:v3.23 |
before 1.26.1-r0 | 1.26.1-r0 |
gst-plugins-badAlpine:v3.24 |
before 1.26.1-r0 | 1.26.1-r0 |
gstreamer1-plugins-bad-freeAlmaLinux:9 |
before 1.22.12-4.el9_6 | 1.22.12-4.el9_6 |
gstreamer1-plugins-bad-free-develAlmaLinux:9 |
before 1.22.12-4.el9_6 | 1.22.12-4.el9_6 |
gstreamer1-plugins-bad-free-libsAlmaLinux:9 |
before 1.22.12-4.el9_6 | 1.22.12-4.el9_6 |
gstreamer1-plugins-bad-freeAlmaLinux:10 |
before 1.24.11-2.el10_0 | 1.24.11-2.el10_0 |
gstreamer1-plugins-bad-free-develAlmaLinux:10 |
before 1.24.11-2.el10_0 | 1.24.11-2.el10_0 |
gstreamer1-plugins-bad-free-libsAlmaLinux:10 |
before 1.24.11-2.el10_0 | 1.24.11-2.el10_0 |
gstreamer1-plugins-bad-freeAlmaLinux:8 |
before 1.16.1-5.el8_10 | 1.16.1-5.el8_10 |
Show 98 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gstreamer1-plugins-bad-free-develAlmaLinux:8 |
before 1.16.1-5.el8_10 | 1.16.1-5.el8_10 |
gstreamer1-plugins-bad-freeTuxCare:AlmaLinux:9.2 |
before 1.18.4-6.el9_2.tuxcare.els1 | 1.18.4-6.el9_2.tuxcare.els1 |
gstreamer1-plugins-bad-free-develTuxCare:AlmaLinux:9.2 |
before 1.18.4-6.el9_2.tuxcare.els1 | 1.18.4-6.el9_2.tuxcare.els1 |
gst-plugins-bad1.0Debian:12 |
before 1.22.0-4+deb12u6, plus listed versions 1.22.0-41.22.0-4+deb12u11.22.0-4+deb12u21.22.0-4+deb12u31.22.0-4+deb12u41.22.0-4+deb12u5 |
1.22.0-4+deb12u6 |
gst-plugins-bad1.0Debian:13 |
before 1.26.1-1 | 1.26.1-1 |
gst-plugins-bad1.0Debian:14 |
before 1.26.1-1 | 1.26.1-1 |
gst-plugins-bad1.0Debian:11 |
before 1.18.4-3+deb11u5, plus listed versions 1.18.4-31.18.4-3+deb11u11.18.4-3+deb11u21.18.4-3+deb11u31.18.4-3+deb11u4 |
1.18.4-3+deb11u5 |
gstreamer1.0-plugins-badMageia:9 |
before 1.22.11-1.1.mga9 | 1.22.11-1.1.mga9 |
gstreamer1.0-plugins-badMageia:9 |
before 1.22.11-1.1.mga9.tainted | 1.22.11-1.1.mga9.tainted |
gstreamer1-plugins-bad-freeRed Hat:enterprise_linux:9::appstream |
before 0:1.22.12-4.el9_6 | 0:1.22.12-4.el9_6 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:1.22.12-4.el9_6 | 0:1.22.12-4.el9_6 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:enterprise_linux:9::appstream |
before 0:1.22.12-4.el9_6 | 0:1.22.12-4.el9_6 |
gstreamer1-plugins-bad-free-libsRed Hat:enterprise_linux:9::appstream |
before 0:1.22.12-4.el9_6 | 0:1.22.12-4.el9_6 |
gstreamer1-plugins-bad-free-libs-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:1.22.12-4.el9_6 | 0:1.22.12-4.el9_6 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:enterprise_linux:9::crb |
before 0:1.22.12-4.el9_6 | 0:1.22.12-4.el9_6 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:enterprise_linux:9::crb |
before 0:1.22.12-4.el9_6 | 0:1.22.12-4.el9_6 |
gstreamer1-plugins-bad-free-develRed Hat:enterprise_linux:9::crb |
before 0:1.22.12-4.el9_6 | 0:1.22.12-4.el9_6 |
gstreamer1-plugins-bad-free-libs-debuginfoRed Hat:enterprise_linux:9::crb |
before 0:1.22.12-4.el9_6 | 0:1.22.12-4.el9_6 |
gstreamer1-plugins-bad-freeRed Hat:enterprise_linux:10.0 |
before 0:1.24.11-2.el10_0 | 0:1.24.11-2.el10_0 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:enterprise_linux:10.0 |
before 0:1.24.11-2.el10_0 | 0:1.24.11-2.el10_0 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:enterprise_linux:10.0 |
before 0:1.24.11-2.el10_0 | 0:1.24.11-2.el10_0 |
gstreamer1-plugins-bad-free-libsRed Hat:enterprise_linux:10.0 |
before 0:1.24.11-2.el10_0 | 0:1.24.11-2.el10_0 |
gstreamer1-plugins-bad-free-libs-debuginfoRed Hat:enterprise_linux:10.0 |
before 0:1.24.11-2.el10_0 | 0:1.24.11-2.el10_0 |
gstreamer1-plugins-bad-free-develRed Hat:enterprise_linux:10.0 |
before 0:1.24.11-2.el10_0 | 0:1.24.11-2.el10_0 |
gstreamer1-plugins-bad-freeRed Hat:enterprise_linux:8::appstream |
before 0:1.16.1-5.el8_10 | 0:1.16.1-5.el8_10 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:1.16.1-5.el8_10 | 0:1.16.1-5.el8_10 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:1.16.1-5.el8_10 | 0:1.16.1-5.el8_10 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:enterprise_linux:8::crb |
before 0:1.16.1-5.el8_10 | 0:1.16.1-5.el8_10 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:enterprise_linux:8::crb |
before 0:1.16.1-5.el8_10 | 0:1.16.1-5.el8_10 |
gstreamer1-plugins-bad-free-develRed Hat:enterprise_linux:8::crb |
before 0:1.16.1-5.el8_10 | 0:1.16.1-5.el8_10 |
gstreamer1-plugins-bad-freeRed Hat:rhel_e4s:8.8::appstream |
before 0:1.16.1-3.el8_8 | 0:1.16.1-3.el8_8 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_e4s:8.8::appstream |
before 0:1.16.1-3.el8_8 | 0:1.16.1-3.el8_8 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_e4s:8.8::appstream |
before 0:1.16.1-3.el8_8 | 0:1.16.1-3.el8_8 |
gstreamer1-plugins-bad-freeRed Hat:rhel_tus:8.8::appstream |
before 0:1.16.1-3.el8_8 | 0:1.16.1-3.el8_8 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_tus:8.8::appstream |
before 0:1.16.1-3.el8_8 | 0:1.16.1-3.el8_8 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_tus:8.8::appstream |
before 0:1.16.1-3.el8_8 | 0:1.16.1-3.el8_8 |
gstreamer1-plugins-bad-freeRed Hat:rhel_e4s:9.2::appstream |
before 0:1.18.4-8.el9_2 | 0:1.18.4-8.el9_2 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_e4s:9.2::appstream |
before 0:1.18.4-8.el9_2 | 0:1.18.4-8.el9_2 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_e4s:9.2::appstream |
before 0:1.18.4-8.el9_2 | 0:1.18.4-8.el9_2 |
gstreamer1-plugins-bad-freeRed Hat:rhel_e4s:9.0::appstream |
before 0:1.18.4-7.el9_0 | 0:1.18.4-7.el9_0 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_e4s:9.0::appstream |
before 0:1.18.4-7.el9_0 | 0:1.18.4-7.el9_0 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_e4s:9.0::appstream |
before 0:1.18.4-7.el9_0 | 0:1.18.4-7.el9_0 |
gstreamer1-plugins-bad-freeRed Hat:rhel_eus:9.4::appstream |
before 0:1.22.1-5.el9_4 | 0:1.22.1-5.el9_4 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_eus:9.4::appstream |
before 0:1.22.1-5.el9_4 | 0:1.22.1-5.el9_4 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_eus:9.4::appstream |
before 0:1.22.1-5.el9_4 | 0:1.22.1-5.el9_4 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_eus:9.4::crb |
before 0:1.22.1-5.el9_4 | 0:1.22.1-5.el9_4 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_eus:9.4::crb |
before 0:1.22.1-5.el9_4 | 0:1.22.1-5.el9_4 |
gstreamer1-plugins-bad-free-develRed Hat:rhel_eus:9.4::crb |
before 0:1.22.1-5.el9_4 | 0:1.22.1-5.el9_4 |
gstreamer1-plugins-bad-freeRed Hat:rhel_aus:8.4::appstream |
before 0:1.16.1-3.el8_4 | 0:1.16.1-3.el8_4 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_aus:8.4::appstream |
before 0:1.16.1-3.el8_4 | 0:1.16.1-3.el8_4 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_aus:8.4::appstream |
before 0:1.16.1-3.el8_4 | 0:1.16.1-3.el8_4 |
gstreamer1-plugins-bad-freeRed Hat:rhel_aus:8.2::appstream |
before 0:1.16.1-3.el8_2 | 0:1.16.1-3.el8_2 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_aus:8.2::appstream |
before 0:1.16.1-3.el8_2 | 0:1.16.1-3.el8_2 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_aus:8.2::appstream |
before 0:1.16.1-3.el8_2 | 0:1.16.1-3.el8_2 |
gstreamer1-plugins-bad-freeRed Hat:rhel_aus:8.6::appstream |
before 0:1.16.1-3.el8_6 | 0:1.16.1-3.el8_6 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_aus:8.6::appstream |
before 0:1.16.1-3.el8_6 | 0:1.16.1-3.el8_6 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_aus:8.6::appstream |
before 0:1.16.1-3.el8_6 | 0:1.16.1-3.el8_6 |
gstreamer1-plugins-bad-freeRed Hat:rhel_e4s:8.6::appstream |
before 0:1.16.1-3.el8_6 | 0:1.16.1-3.el8_6 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_e4s:8.6::appstream |
before 0:1.16.1-3.el8_6 | 0:1.16.1-3.el8_6 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_e4s:8.6::appstream |
before 0:1.16.1-3.el8_6 | 0:1.16.1-3.el8_6 |
gstreamer1-plugins-bad-freeRed Hat:rhel_tus:8.6::appstream |
before 0:1.16.1-3.el8_6 | 0:1.16.1-3.el8_6 |
gstreamer1-plugins-bad-free-debuginfoRed Hat:rhel_tus:8.6::appstream |
before 0:1.16.1-3.el8_6 | 0:1.16.1-3.el8_6 |
gstreamer1-plugins-bad-free-debugsourceRed Hat:rhel_tus:8.6::appstream |
before 0:1.16.1-3.el8_6 | 0:1.16.1-3.el8_6 |
gstreamer1-plugins-bad-freeRocky Linux:9 |
before 0:1.22.12-4.el9_6 | 0:1.22.12-4.el9_6 |
gstreamer1-plugins-bad-freeRocky Linux:10 |
before 0:1.24.11-2.el10_0 | 0:1.24.11-2.el10_0 |
gstreamer1-plugins-bad-freeRocky Linux:8 |
before 0:1.16.1-5.el8_10 | 0:1.16.1-5.el8_10 |
gst-plugins-bad1.0Root:Ubuntu:24.04 |
before 1.24.2-1ubuntu4.aikido.1 | 1.24.2-1ubuntu4.aikido.1 |
rootio-gst-plugins-bad1.0Root:Ubuntu:24.04 |
before 1.24.2-1ubuntu4.aikido.1 | 1.24.2-1ubuntu4.aikido.1 |
gstreamer-plugins-badSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 1.22.0-150500.3.28.1 | 1.22.0-150500.3.28.1 |
gstreamer-plugins-badSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 1.22.0-150500.3.28.1 | 1.22.0-150500.3.28.1 |
gstreamer-plugins-badSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 1.22.0-150500.3.28.1 | 1.22.0-150500.3.28.1 |
gstreamer-plugins-badSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 1.22.0-150500.3.28.1 | 1.22.0-150500.3.28.1 |
gstreamer-plugins-badSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 1.16.3-150300.9.21.1 | 1.16.3-150300.9.21.1 |
gstreamer-plugins-badSUSE:Linux Enterprise Server 15 SP3-LTSS |
before 1.16.3-150300.9.21.1 | 1.16.3-150300.9.21.1 |
gstreamer-plugins-badSUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 1.16.3-150300.9.21.1 | 1.16.3-150300.9.21.1 |
gstreamer-plugins-badSUSE:Enterprise Storage 7.1 |
before 1.16.3-150300.9.21.1 | 1.16.3-150300.9.21.1 |
gstreamer-plugins-badSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 1.20.1-150400.3.26.1 | 1.20.1-150400.3.26.1 |
gstreamer-plugins-badSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 1.20.1-150400.3.26.1 | 1.20.1-150400.3.26.1 |
gstreamer-plugins-badSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 1.20.1-150400.3.26.1 | 1.20.1-150400.3.26.1 |
gstreamer-plugins-badSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 1.20.1-150400.3.26.1 | 1.20.1-150400.3.26.1 |
gstreamer-plugins-badSUSE:Manager Proxy 4.3 |
before 1.20.1-150400.3.26.1 | 1.20.1-150400.3.26.1 |
gstreamer-plugins-badSUSE:Manager Server 4.3 |
before 1.20.1-150400.3.26.1 | 1.20.1-150400.3.26.1 |
gstreamer-plugins-badSUSE:Linux Enterprise Server 12 SP5-LTSS |
before 1.8.3-18.18.1 | 1.8.3-18.18.1 |
gstreamer-plugins-badSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 1.8.3-18.18.1 | 1.8.3-18.18.1 |
gstreamer-plugins-badSUSE:Linux Enterprise Module for Basesystem 15 SP6 |
before 1.24.0-150600.4.3.1 | 1.24.0-150600.4.3.1 |
gstreamer-plugins-badSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 1.24.0-150600.4.3.1 | 1.24.0-150600.4.3.1 |
gstreamer-plugins-badSUSE:Linux Enterprise Module for Desktop Applications 15 SP6 |
before 1.24.0-150600.4.3.1 | 1.24.0-150600.4.3.1 |
gstreamer-plugins-badSUSE:Linux Enterprise Module for Desktop Applications 15 SP7 |
before 1.24.0-150600.4.3.1 | 1.24.0-150600.4.3.1 |
gstreamer-plugins-badSUSE:Linux Enterprise Module for Package Hub 15 SP6 |
before 1.24.0-150600.4.3.1 | 1.24.0-150600.4.3.1 |
gstreamer-plugins-badSUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 1.24.0-150600.4.3.1 | 1.24.0-150600.4.3.1 |
gst-plugins-bad1.0Ubuntu:Pro:16.04:LTS |
before 1.8.3-1ubuntu0.2+esm1, plus listed versions 1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.1-1ubuntu3 Show 9 moreShow less1.7.1-1ubuntu41.7.2-1ubuntu11.7.90-1ubuntu21.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.2-1ubuntu0.21.8.3-1ubuntu0.2 |
1.8.3-1ubuntu0.2+esm1 |
gst-plugins-bad1.0Ubuntu:Pro:18.04:LTS |
before 1.14.5-0ubuntu1~18.04.1+esm1, plus listed versions 1.12.3-1ubuntu11.12.3-1ubuntu21.12.3-2ubuntu11.12.4-2ubuntu11.12.4-2ubuntu2 Show 6 moreShow less1.13.1-1ubuntu11.13.91-1ubuntu11.14.0-1ubuntu11.14.1-1ubuntu1~ubuntu18.04.11.14.4-1ubuntu1~ubuntu18.04.11.14.5-0ubuntu1~18.04.1 |
1.14.5-0ubuntu1~18.04.1+esm1 |
gst-plugins-bad1.0Ubuntu:Pro:20.04:LTS |
before 1.16.3-0ubuntu1.1+esm1, plus listed versions 1.16.1-1ubuntu11.16.1-1ubuntu31.16.1-1ubuntu41.16.1-1ubuntu51.16.1-1ubuntu6 Show 7 moreShow less1.16.1-1ubuntu81.16.2-1ubuntu11.16.2-1ubuntu21.16.2-2ubuntu11.16.2-2.1ubuntu11.16.3-0ubuntu11.16.3-0ubuntu1.1 |
1.16.3-0ubuntu1.1+esm1 |
gst-plugins-bad1.0Ubuntu:Pro:22.04:LTS |
before 1.20.3-0ubuntu1.1+esm2, plus listed versions 1.18.5-1ubuntu11.18.5-1ubuntu31.20.0-2ubuntu21.20.1-1ubuntu21.20.3-0ubuntu11.20.3-0ubuntu1.1 |
1.20.3-0ubuntu1.1+esm2 |
gst-plugins-bad1.0Ubuntu:Pro:24.04:LTS |
before 1.24.2-1ubuntu4+esm1, plus listed versions 1.22.4-1ubuntu11.22.4-1ubuntu21.22.4-1ubuntu41.22.9-2ubuntu11.24.0-1ubuntu31.24.0-1ubuntu41.24.2-1ubuntu4 |
1.24.2-1ubuntu4+esm1 |
gst-plugins-bad1.0Ubuntu:Pro:20.04:LTS From an advisory covering 3 CVEs |
before 1.16.3-0ubuntu1.1+esm1, plus listed versions 1.16.1-1ubuntu11.16.1-1ubuntu31.16.1-1ubuntu41.16.1-1ubuntu51.16.1-1ubuntu6 Show 7 moreShow less1.16.1-1ubuntu81.16.2-1ubuntu11.16.2-1ubuntu21.16.2-2ubuntu11.16.2-2.1ubuntu11.16.3-0ubuntu11.16.3-0ubuntu1.1 |
1.16.3-0ubuntu1.1+esm1 |
gst-plugins-bad1.0Ubuntu:Pro:22.04:LTS From an advisory covering 3 CVEs |
before 1.20.3-0ubuntu1.1+esm2, plus listed versions 1.18.5-1ubuntu11.18.5-1ubuntu31.20.0-2ubuntu21.20.1-1ubuntu21.20.3-0ubuntu11.20.3-0ubuntu1.1 |
1.20.3-0ubuntu1.1+esm2 |
gst-plugins-bad1.0Ubuntu:Pro:24.04:LTS From an advisory covering 3 CVEs |
before 1.24.2-1ubuntu4+esm1, plus listed versions 1.22.4-1ubuntu11.22.4-1ubuntu21.22.4-1ubuntu41.22.9-2ubuntu11.24.0-1ubuntu31.24.0-1ubuntu41.24.2-1ubuntu4 |
1.24.2-1ubuntu4+esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-3887 is a high vulnerability (CVSS 8.8) in Gstreamer, published May 22, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in gst-plugins-bad 1.26.1-r0.
References
zerodayinitiative.com/advisories/ZDI-25-267
lists.debian.org/debian-lts-announce/2025/06/msg00017.html
nvd.nist.gov/vuln/detail/CVE-2025-3887
github.com/advisories/GHSA-vm2x-3jwq-mv8x
security.alpinelinux.org/vuln/CVE-2025-3887
access.redhat.com/errata/RHSA-2025:8183
Show 52 moreShow less
bugzilla.redhat.com/2367919
errata.almalinux.org/9/ALSA-2025-8183.html
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1753729945.html
security-tracker.debian.org/tracker/CVE-2025-3887
advisories.mageia.org/MGASA-2025-0264.html
bugs.mageia.org/show_bug.cgi?id=34356
ubuntu.com/security/notices/USN-7558-1
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8183.json
cve.org/CVERecord?id=CVE-2025-3887
errata.rockylinux.org/RLSA-2025:8183
suse.com/support/update/announcement/2025/suse-su-202501717-1
bugzilla.suse.com/1242809
gstreamer.freedesktop.org/security/sa-2025-0001.html
gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d0e18d6353e4e448ccf3b06a967b394e664dd0b5