Stack-based Buffer Overflow in GStreamer H265 Codec
CVE-2025-3887

8.8HIGH

Key Information:

Vendor

Gstreamer

Status
Gstreamer
Vendor
CVE Published:
22 May 2025

What is CVE-2025-3887?

The GStreamer H265 Codec exhibits a vulnerability due to improper validation of the length of user-supplied data during the parsing of H265 slice headers. This flaw can lead to a stack-based buffer overflow, enabling remote attackers to execute arbitrary code in the context of the current process. Successful exploitation necessitates some level of interaction with the library, but various attack vectors may exist depending on the specific implementation.

Affected Version(s)

GStreamer 2e8b542145c1b11f8b8d927f6c679fd8028ceb60

References

https://www.zerodayinitiative.com/advisories/ZDI-25-267/
x_research-advisory

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.