Every CVE Search/ Get API key

CVE-2025-47219

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the...

8.1 HighFix available

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.71%Up 0.7 points since Aug 8, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.1

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.

Record
CVE-2025-47219
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2025-23945 8.1

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.

Record
EUVD-2025-23945
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-8h3r-68m6-vm7c 8.1

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the...

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.

Record
GHSA-8h3r-68m6-vm7c
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-125
Updated
2026-11-02
NVD 8.1

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.

Record
CVE-2025-47219
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVALPINE-CVE-2025-47219 8.1

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.

Record
ALPINE-CVE-2025-47219
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 8.1

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.

Record
CVE-2025-47219
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 11 moreShow less
OSVDEBIAN-CVE-2025-47219 8.1

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.

Record
DEBIAN-CVE-2025-47219
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-1705 3.3

gstreamer1-plugins-good security update

Security Fix(es):

(CVE-2025-47219)

Record
OESA-2025-1705
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2025-47219 8.1

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.

Record
UBUNTU-CVE-2025-47219
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-java-2025-47219 No score

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.

Record
BIT-java-2025-47219
Updated
2026-11-02
OSVBIT-java-min-2025-47219 No score

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.

Record
BIT-java-min-2025-47219
Updated
2026-11-02
OSVBIT-jre-2025-47219 No score

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.

Record
BIT-jre-2025-47219
Updated
2026-11-02
OSVSUSE-SU-2025:02053-1 No score

Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues:

  • CVE-2025-47183: Fixed out-of-bounds read in MOV/MP4 demuxer (bsc#1244406).
  • CVE-2025-47219: Fixed out-of-bounds read in MOV/MP4 demuxer (bsc#1244405).
  • CVE-2024-47540: Fixed uninitialized stack memory in Matroska/WebM demuxer (bsc#1234421).
Record
SUSE-SU-2025:02053-1
Updated
2026-11-02
OSVSUSE-SU-2025:02058-1 No score

Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues:

  • CVE-2025-47183: Fixed out-of-bounds read in MOV/MP4 demuxer (bsc#1244406).
  • CVE-2025-47219: Fixed out-of-bounds read in MOV/MP4 demuxer (bsc#1244405).
  • CVE-2024-47540: Fixed uninitialized stack memory in Matroska/WebM demuxer (bsc#1234421).
Record
SUSE-SU-2025:02058-1
Updated
2026-11-02
OSVSUSE-SU-2025:02347-1 No score

Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues:

  • CVE-2025-47183: Fixed out-of-bounds read in MOV/MP4 demuxer (bsc#1244406).
  • CVE-2025-47219: Fixed out-of-bounds read in MOV/MP4 demuxer (bsc#1244405).
  • CVE-2024-47540: Fixed uninitialized stack memory in Matroska/WebM demuxer (bsc#1234421).
Record
SUSE-SU-2025:02347-1
Updated
2026-11-02
OSVUSN-7717-1 No score

gst-plugins-good1.0 vulnerabilities

Shaun Mirani discovered that GStreamer Good Plugins incorrectly handled certain malformed media files. An attacker could use these issues to cause GStreamer Good Plugins to crash, resulting in a denial of service, or possibly disclose sensitive information.

Record
USN-7717-1
Updated
2026-11-02
OSVUSN-7837-1 No score

gst-plugins-good1.0 vulnerability

Shaun Mirani discovered that GStreamer Good Plugins incorrectly handled certain malformed media files. An attacker could possibly use this issue to cause GStreamer Good Plugins to crash, resulting in a denial of service, or disclose sensitive information.

Record
USN-7837-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gst-plugins-good
Alpine:v3.22
 before 1.26.2-r0
1.26.2-r0
gst-plugins-good
Alpine:v3.23
 before 1.26.2-r0
1.26.2-r0
gst-plugins-good
Alpine:v3.24
 before 1.26.2-r0
1.26.2-r0
java
Bitnami
 before 1.8.0, 1.9.0 up to 8.0.481
1.8.08.0.481
java-min
Bitnami
 before 1.8.0, 1.9.0 up to 8.0.481
1.8.08.0.481
jre
Bitnami
 before 1.8.0, 1.9.0 up to 8.0.481
1.8.08.0.481
gst-plugins-good1.0
Debian:12
 before 1.22.0-5+deb12u3, plus listed versions
1.22.0-51.22.0-5+deb12u11.22.0-5+deb12u2
1.22.0-5+deb12u3
gst-plugins-good1.0
Debian:13
 before 1.26.2-1
1.26.2-1
gst-plugins-good1.0
Debian:14
 before 1.26.2-1
1.26.2-1
gst-plugins-good1.0
Debian:11
From an advisory covering 2 CVEs
 before 1.18.4-2+deb11u4, plus listed versions
1.18.4-21.18.4-2+deb11u11.18.4-2+deb11u21.18.4-2+deb11u3
1.18.4-2+deb11u4
Show 22 moreShow less
Affected packages
PackageAffectedFixed
gstreamer1-plugins-good
openEuler:24.03-LTS-SP1
 before 1.20.3-5.oe2403sp1
1.20.3-5.oe2403sp1
gstreamer1-plugins-good
openEuler:20.03-LTS-SP4
 before 1.16.2-10.oe2003sp4
1.16.2-10.oe2003sp4
gstreamer1-plugins-good
openEuler:22.03-LTS-SP3
 before 1.16.2-10.oe2203sp3
1.16.2-10.oe2203sp3
gstreamer1-plugins-good
openEuler:22.03-LTS-SP4
 before 1.16.2-10.oe2203sp4
1.16.2-10.oe2203sp4
gstreamer1-plugins-good
openEuler:24.03-LTS
 before 1.20.3-5.oe2403
1.20.3-5.oe2403
gstreamer-plugins-good
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 3 CVEs
 before 1.22.0-150500.4.10.1
1.22.0-150500.4.10.1
gstreamer-plugins-good
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 3 CVEs
 before 1.22.0-150500.4.10.1
1.22.0-150500.4.10.1
gstreamer-plugins-good
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 3 CVEs
 before 1.22.0-150500.4.10.1
1.22.0-150500.4.10.1
gstreamer-plugins-good
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 3 CVEs
 before 1.22.0-150500.4.10.1
1.22.0-150500.4.10.1
gstreamer-plugins-good
SUSE:Linux Enterprise Module for Basesystem 15 SP6
From an advisory covering 3 CVEs
 before 1.24.0-150600.3.7.1
1.24.0-150600.3.7.1
gstreamer-plugins-good
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 3 CVEs
 before 1.24.0-150600.3.7.1
1.24.0-150600.3.7.1
gstreamer-plugins-good
SUSE:Linux Enterprise Workstation Extension 15 SP6
From an advisory covering 3 CVEs
 before 1.24.0-150600.3.7.1
1.24.0-150600.3.7.1
gstreamer-plugins-good
SUSE:Linux Enterprise Workstation Extension 15 SP7
From an advisory covering 3 CVEs
 before 1.24.0-150600.3.7.1
1.24.0-150600.3.7.1
gstreamer-plugins-good
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 1.24.0-150600.3.7.1
1.24.0-150600.3.7.1
gst-plugins-good1.0
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.6.0-1ubuntu11.6.1-1ubuntu11.6.2-1ubuntu11.7.1-1ubuntu11.7.2-1ubuntu1
Show 14 moreShow less
1.7.90-1ubuntu11.7.91-1ubuntu11.8.0-1ubuntu11.8.1-1ubuntu0.11.8.2-1ubuntu0.11.8.2-1ubuntu0.21.8.2-1ubuntu0.31.8.3-1ubuntu0.31.8.3-1ubuntu0.41.8.3-1ubuntu0.51.8.3-1ubuntu0.5+esm11.8.3-1ubuntu0.5+esm21.8.3-1ubuntu0.5+esm31.8.3-1ubuntu0.5+esm4
 None known
gst-plugins-good1.0
Ubuntu:Pro:18.04:LTS
 before 1.14.5-0ubuntu1~18.04.3+esm1, plus listed versions
1.12.3-1ubuntu11.12.4-1ubuntu11.13.1-1ubuntu11.13.91-1ubuntu11.14.0-1ubuntu1
Show 5 moreShow less
1.14.1-1ubuntu1~ubuntu18.04.11.14.4-1ubuntu1~ubuntu18.04.11.14.5-0ubuntu1~18.04.11.14.5-0ubuntu1~18.04.21.14.5-0ubuntu1~18.04.3
1.14.5-0ubuntu1~18.04.3+esm1
gst-plugins-good1.0
Ubuntu:Pro:20.04:LTS
 before 1.16.3-0ubuntu1.3+esm1, plus listed versions
1.16.1-1ubuntu11.16.2-1ubuntu11.16.2-1ubuntu21.16.2-1ubuntu2.11.16.3-0ubuntu11.16.3-0ubuntu1.11.16.3-0ubuntu1.21.16.3-0ubuntu1.3
1.16.3-0ubuntu1.3+esm1
gst-plugins-good1.0
Ubuntu:22.04:LTS
 before 1.20.3-0ubuntu1.4, plus listed versions
1.18.5-1ubuntu21.18.5-1ubuntu31.20.0-2ubuntu11.20.1-1ubuntu11.20.3-0ubuntu11.20.3-0ubuntu1.11.20.3-0ubuntu1.3
1.20.3-0ubuntu1.4
gst-plugins-good1.0
Ubuntu:24.04:LTS
 before 1.24.2-1ubuntu1.2, plus listed versions
1.22.6-1ubuntu11.22.6-1ubuntu21.22.8-3ubuntu11.22.9-1ubuntu11.24.0-1ubuntu5
Show 4 moreShow less
1.24.0-1ubuntu71.24.1-2ubuntu11.24.2-1ubuntu11.24.2-1ubuntu1.1
1.24.2-1ubuntu1.2
gst-plugins-good1.0
Ubuntu:25.10
 before 1.26.2-1ubuntu1, plus listed versions
1.26.0-1ubuntu21.26.0-1ubuntu3
1.26.2-1ubuntu1
gst-plugins-good1.0
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 1.20.3-0ubuntu1.4, plus listed versions
1.18.5-1ubuntu21.18.5-1ubuntu31.20.0-2ubuntu11.20.1-1ubuntu11.20.3-0ubuntu11.20.3-0ubuntu1.11.20.3-0ubuntu1.3
1.20.3-0ubuntu1.4
gst-plugins-good1.0
Ubuntu:24.04:LTS
From an advisory covering 2 CVEs
 before 1.24.2-1ubuntu1.2, plus listed versions
1.22.6-1ubuntu11.22.6-1ubuntu21.22.8-3ubuntu11.22.9-1ubuntu11.24.0-1ubuntu5
Show 4 moreShow less
1.24.0-1ubuntu71.24.1-2ubuntu11.24.2-1ubuntu11.24.2-1ubuntu1.1
1.24.2-1ubuntu1.2

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-47219 is a high vulnerability (CVSS 8.1) in Gstreamer, published June 20, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. Fixed in gst-plugins-good 1.26.2-r0.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open