Every CVE Search/ Get API key

CVE-2025-47183

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the...

6.6 MediumFix available

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
High

Exploit likelihood

0.22%Up 0.2 points since Aug 8, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.6

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure.

Record
CVE-2025-47183
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2025-23946 6.6

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure.

Record
EUVD-2025-23946
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-p7rv-557w-hw2m 6.6

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the...

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure.

Record
GHSA-p7rv-557w-hw2m
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
NVD 6.6

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure.

Record
CVE-2025-47183
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVALPINE-CVE-2025-47183 6.6

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure.

Record
ALPINE-CVE-2025-47183
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-03
OSV 6.6

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure.

Record
CVE-2025-47183
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2025-47183 6.6

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure.

Record
DEBIAN-CVE-2025-47183
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2316 6.6

gstreamer1-plugins-good security update

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types or processing capabilities can be added simply by installing new plugins.

Security Fix(es):

A vulnerability, which was classified as problematic, was found in GStreamer up to 1.26.1 (Multimedia Processing Software).CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.This is going to have an impact on confidentiality.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-47183)

Record
OESA-2025-2316
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-47183 6.6

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure.

Record
UBUNTU-CVE-2025-47183
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVSUSE-SU-2025:02053-1 No score

Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues:

  • CVE-2025-47183: Fixed out-of-bounds read in MOV/MP4 demuxer (bsc#1244406).
  • CVE-2025-47219: Fixed out-of-bounds read in MOV/MP4 demuxer (bsc#1244405).
  • CVE-2024-47540: Fixed uninitialized stack memory in Matroska/WebM demuxer (bsc#1234421).
Record
SUSE-SU-2025:02053-1
Updated
2026-11-02
OSVSUSE-SU-2025:02058-1 No score

Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues:

  • CVE-2025-47183: Fixed out-of-bounds read in MOV/MP4 demuxer (bsc#1244406).
  • CVE-2025-47219: Fixed out-of-bounds read in MOV/MP4 demuxer (bsc#1244405).
  • CVE-2024-47540: Fixed uninitialized stack memory in Matroska/WebM demuxer (bsc#1234421).
Record
SUSE-SU-2025:02058-1
Updated
2026-11-02
OSVSUSE-SU-2025:02303-1 No score

Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues:

  • CVE-2025-47183: Fixed out-of-bounds read when parsing mvhd box (bsc#1244406).
Record
SUSE-SU-2025:02303-1
Updated
2026-11-02
OSVSUSE-SU-2025:02347-1 No score

Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues:

  • CVE-2025-47183: Fixed out-of-bounds read in MOV/MP4 demuxer (bsc#1244406).
  • CVE-2025-47219: Fixed out-of-bounds read in MOV/MP4 demuxer (bsc#1244405).
  • CVE-2024-47540: Fixed uninitialized stack memory in Matroska/WebM demuxer (bsc#1234421).
Record
SUSE-SU-2025:02347-1
Updated
2026-11-02
OSVUSN-7717-1 No score

gst-plugins-good1.0 vulnerabilities

Shaun Mirani discovered that GStreamer Good Plugins incorrectly handled certain malformed media files. An attacker could use these issues to cause GStreamer Good Plugins to crash, resulting in a denial of service, or possibly disclose sensitive information.

Record
USN-7717-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gst-plugins-good
Alpine:v3.22
 before 1.26.2-r0
1.26.2-r0
gst-plugins-good
Alpine:v3.23
 before 1.26.2-r0
1.26.2-r0
gst-plugins-good
Alpine:v3.24
 before 1.26.2-r0
1.26.2-r0
gst-plugins-good1.0
Debian:12
 before 1.22.0-5+deb12u4, plus listed versions
1.22.0-51.22.0-5+deb12u11.22.0-5+deb12u21.22.0-5+deb12u3
1.22.0-5+deb12u4
gst-plugins-good1.0
Debian:13
 before 1.26.2-1
1.26.2-1
gst-plugins-good1.0
Debian:14
 before 1.26.2-1
1.26.2-1
gst-plugins-good1.0
Debian:11
From an advisory covering 2 CVEs
 before 1.18.4-2+deb11u4, plus listed versions
1.18.4-21.18.4-2+deb11u11.18.4-2+deb11u21.18.4-2+deb11u3
1.18.4-2+deb11u4
gstreamer1-plugins-good
openEuler:24.03-LTS-SP2
 before 1.20.3-6.oe2403sp2
1.20.3-6.oe2403sp2
gstreamer1-plugins-good
openEuler:20.03-LTS-SP4
 before 1.16.2-11.oe2003sp4
1.16.2-11.oe2003sp4
gstreamer1-plugins-good
openEuler:22.03-LTS-SP3
 before 1.16.2-11.oe2203sp3
1.16.2-11.oe2203sp3
Show 21 moreShow less
Affected packages
PackageAffectedFixed
gstreamer1-plugins-good
openEuler:22.03-LTS-SP4
 before 1.16.2-11.oe2203sp4
1.16.2-11.oe2203sp4
gstreamer1-plugins-good
openEuler:24.03-LTS
 before 1.20.3-6.oe2403sp1
1.20.3-6.oe2403sp1
gstreamer1-plugins-good
openEuler:24.03-LTS-SP1
 before 1.20.3-6.oe2403sp1
1.20.3-6.oe2403sp1
gstreamer-plugins-good
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 3 CVEs
 before 1.22.0-150500.4.10.1
1.22.0-150500.4.10.1
gstreamer-plugins-good
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 3 CVEs
 before 1.22.0-150500.4.10.1
1.22.0-150500.4.10.1
gstreamer-plugins-good
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 3 CVEs
 before 1.22.0-150500.4.10.1
1.22.0-150500.4.10.1
gstreamer-plugins-good
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 3 CVEs
 before 1.22.0-150500.4.10.1
1.22.0-150500.4.10.1
gstreamer-plugins-good
SUSE:Linux Enterprise Module for Basesystem 15 SP6
From an advisory covering 3 CVEs
 before 1.24.0-150600.3.7.1
1.24.0-150600.3.7.1
gstreamer-plugins-good
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 3 CVEs
 before 1.24.0-150600.3.7.1
1.24.0-150600.3.7.1
gstreamer-plugins-good
SUSE:Linux Enterprise Workstation Extension 15 SP6
From an advisory covering 3 CVEs
 before 1.24.0-150600.3.7.1
1.24.0-150600.3.7.1
gstreamer-plugins-good
SUSE:Linux Enterprise Workstation Extension 15 SP7
From an advisory covering 3 CVEs
 before 1.24.0-150600.3.7.1
1.24.0-150600.3.7.1
gstreamer-plugins-good
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 1.24.0-150600.3.7.1
1.24.0-150600.3.7.1
gstreamer-plugins-good
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 1.8.3-16.16.1
1.8.3-16.16.1
gst-plugins-good1.0
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.2-1ubuntu1
Show 14 moreShow less
1.7.90-1ubuntu11.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.2-1ubuntu0.21.8.2-1ubuntu0.31.8.3-1ubuntu0.31.8.3-1ubuntu0.41.8.3-1ubuntu0.51.8.3-1ubuntu0.5+esm11.8.3-1ubuntu0.5+esm21.8.3-1ubuntu0.5+esm31.8.3-1ubuntu0.5+esm4
 None known
gst-plugins-good1.0
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.12.3-1ubuntu11.12.4-1ubuntu11.13.1-1ubuntu11.13.91-1ubuntu11.14.0-1ubuntu1
Show 9 moreShow less
1.14.1-1ubuntu1~ubuntu18.04.11.14.4-1ubuntu1~ubuntu18.04.11.14.5-0ubuntu1~18.04.11.14.5-0ubuntu1~18.04.21.14.5-0ubuntu1~18.04.31.14.5-0ubuntu1~18.04.3+esm11.14.5-0ubuntu1~18.04.3+esm21.14.5-0ubuntu1~18.04.3+esm31.14.5-0ubuntu1~18.04.3+esm4
 None known
gst-plugins-good1.0
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.16.1-1ubuntu11.16.2-1ubuntu11.16.2-1ubuntu21.16.2-1ubuntu2.11.16.3-0ubuntu1
Show 7 moreShow less
1.16.3-0ubuntu1.11.16.3-0ubuntu1.21.16.3-0ubuntu1.31.16.3-0ubuntu1.3+esm11.16.3-0ubuntu1.3+esm21.16.3-0ubuntu1.3+esm31.16.3-0ubuntu1.3+esm4
 None known
gst-plugins-good1.0
Ubuntu:22.04:LTS
 before 1.20.3-0ubuntu1.4, plus listed versions
1.18.5-1ubuntu21.18.5-1ubuntu31.20.0-2ubuntu11.20.1-1ubuntu11.20.3-0ubuntu11.20.3-0ubuntu1.11.20.3-0ubuntu1.3
1.20.3-0ubuntu1.4
gst-plugins-good1.0
Ubuntu:24.04:LTS
 before 1.24.2-1ubuntu1.2, plus listed versions
1.22.6-1ubuntu11.22.6-1ubuntu21.22.8-3ubuntu11.22.9-1ubuntu11.24.0-1ubuntu5
Show 4 moreShow less
1.24.0-1ubuntu71.24.1-2ubuntu11.24.2-1ubuntu11.24.2-1ubuntu1.1
1.24.2-1ubuntu1.2
gst-plugins-good1.0
Ubuntu:25.10
 before 1.26.2-1ubuntu1, plus listed versions
1.26.0-1ubuntu21.26.0-1ubuntu3
1.26.2-1ubuntu1
gst-plugins-good1.0
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 1.20.3-0ubuntu1.4, plus listed versions
1.18.5-1ubuntu21.18.5-1ubuntu31.20.0-2ubuntu11.20.1-1ubuntu11.20.3-0ubuntu11.20.3-0ubuntu1.11.20.3-0ubuntu1.3
1.20.3-0ubuntu1.4
gst-plugins-good1.0
Ubuntu:24.04:LTS
From an advisory covering 2 CVEs
 before 1.24.2-1ubuntu1.2, plus listed versions
1.22.6-1ubuntu11.22.6-1ubuntu21.22.8-3ubuntu11.22.9-1ubuntu11.24.0-1ubuntu5
Show 4 moreShow less
1.24.0-1ubuntu71.24.1-2ubuntu11.24.2-1ubuntu11.24.2-1ubuntu1.1
1.24.2-1ubuntu1.2

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-47183 is a medium vulnerability (CVSS 6.6) in Gstreamer, published June 20, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in gst-plugins-good 1.26.2-r0.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open