high 8.8

CVE-2025-3887 json

GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

published 2025-05-22 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-16092

cvss: 8.8; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits: 0; none known

GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26596.

Patch / fix

fixed in 1 distros 7

gstreamer gstreamer 1.26.1

debian ubuntu red hat suse almalinux rocky linux alpine

gst-plugins-bad1.0 Debian 12 1.22.0-4+deb12u6
gst-plugins-bad1.0 Debian 14, Debian 13 1.26.1-1

debian advisories DEBIAN-CVE-2025-3887

gst-plugins-bad1.0 Ubuntu Pro 16.04 LTS 1.8.3-1ubuntu0.2+esm1
gst-plugins-bad1.0 Ubuntu Pro 18.04 LTS 1.14.5-0ubuntu1~18.04.1+esm1
gst-plugins-bad1.0 Ubuntu Pro 20.04 LTS 1.16.3-0ubuntu1.1+esm1
gst-plugins-bad1.0 Ubuntu Pro 22.04 LTS 1.20.3-0ubuntu1.1+esm2
gst-plugins-bad1.0 Ubuntu Pro 24.04 LTS 1.24.2-1ubuntu4+esm1

ubuntu advisories UBUNTU-CVE-2025-3887

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

gstreamer1-plugins-bad-free RHEL 8 1.16.1-5.el8_10
gstreamer1-plugins-bad-free RHEL 10.0 1.24.11-2.el10_0
gstreamer1-plugins-bad-free-libs RHEL 10.0 1.24.11-2.el10_0
gstreamer1-plugins-bad-free RHEL 9 1.22.12-4.el9_6
gstreamer1-plugins-bad-free-libs RHEL 9 1.22.12-4.el9_6
gstreamer1-plugins-bad-free RHEL 8.6 TUS, RHEL 8.6 E4S, RHEL 8.6 AUS 1.16.1-3.el8_6
gstreamer1-plugins-bad-free RHEL 8.2 AUS 1.16.1-3.el8_2
gstreamer1-plugins-bad-free RHEL 9.4 EUS 1.22.1-5.el9_4

red hat advisories RHSA-2025:9056 RHSA-2025:8981 RHSA-2025:8979 RHSA-2025:8980 RHSA-2025:8977 RHSA-2025:8978

gstreamer-plugins-bad SLE Module for Package Hub 15 SP7, SLE Module for Package Hub 15 SP6, SLE Module for Desktop Applications 15 SP7 +3 more 1.24.0-150600.4.3.1
gstreamer-plugins-bad SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +3 more 1.20.1-150400.3.26.1
gstreamer-plugins-bad SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 1.16.3-150300.9.21.1
gstreamer-plugins-bad SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 1.22.0-150500.3.28.1
gstreamer-plugins-bad SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.8.3-18.18.1

suse advisories SUSE-SU-2025:01737-1 SUSE-SU-2025:01729-1 SUSE-SU-2025:01725-1 SUSE-SU-2025:01718-1 SUSE-SU-2025:01717-1

gstreamer1-plugins-bad-free AlmaLinux 9 1.22.12-4.el9_6
gstreamer1-plugins-bad-free-libs AlmaLinux 9 1.22.12-4.el9_6
gstreamer1-plugins-bad-free AlmaLinux 10 1.24.11-2.el10_0
gstreamer1-plugins-bad-free-libs AlmaLinux 10 1.24.11-2.el10_0
gstreamer1-plugins-bad-free AlmaLinux 8 1.16.1-5.el8_10

almalinux advisories ALSA-2025:8183 ALSA-2025:8184 ALSA-2025:8201

gstreamer1-plugins-bad-free Rocky Linux 9 1.22.12-4.el9_6
gstreamer1-plugins-bad-free Rocky Linux 10 1.24.11-2.el10_0
gstreamer1-plugins-bad-free Rocky Linux 8 1.16.1-5.el8_10

rocky linux advisories RLSA-2025:8183 RLSA-2025:8184 RLSA-2025:8201

gst-plugins-bad Alpine 3.24, Alpine 3.23, Alpine 3.22 1.26.1-r0

alpine advisories ALPINE-CVE-2025-3887

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-3887 updated 2026-11-04 cvss 8.8

gstreamer1-plugins-bad-free: mingw-gstreamer1-plugins-bad-free: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Red Hat Enterprise Linux 8 mingw-gstreamer1-plugins-bad-free, mingw32-gstreamer1-plugins-bad-free, mingw64-gstreamer1-plugins-bad-free
affected: workaround, no fix available
Red Hat CodeReady Linux Builder EUS (v.9.4) gstreamer1-plugins-bad-free-devel 1.22.1-5.el9_4, gstreamer1-plugins-bad-free-debuginfo 1.22.1-5.el9_4, gstreamer1-plugins-bad-free-debugsource 1.22.1-5.el9_4
fixed: vendor fix RHSA-2025:8979
Red Hat Enterprise Linux AppStream (v. 8) gstreamer1-plugins-bad-free 1.16.1-5.el8_10
fixed: vendor fix RHSA-2025:8201
Red Hat Enterprise Linux AppStream (v. 9) gstreamer1-plugins-bad-free 1.22.12-4.el9_6, gstreamer1-plugins-bad-free-libs 1.22.12-4.el9_6
fixed: vendor fix RHSA-2025:8183
Red Hat Enterprise Linux AppStream (v. 10) gstreamer1-plugins-bad-free 1.24.11-2.el10_0, gstreamer1-plugins-bad-free-libs 1.24.11-2.el10_0
fixed: vendor fix RHSA-2025:8184
Red Hat Enterprise Linux AppStream AUS (v. 8.2) gstreamer1-plugins-bad-free 1.16.1-3.el8_2
fixed: vendor fix RHSA-2025:8981
Red Hat Enterprise Linux AppStream AUS (v.8.4) gstreamer1-plugins-bad-free 1.16.1-3.el8_4
fixed: vendor fix RHSA-2025:8980
Red Hat Enterprise Linux AppStream AUS (v.8.6) gstreamer1-plugins-bad-free 1.16.1-3.el8_6 Red Hat Enterprise Linux AppStream E4S (v.8.6) gstreamer1-plugins-bad-free 1.16.1-3.el8_6
fixed: vendor fix RHSA-2025:9056

show 10 more

Red Hat Enterprise Linux AppStream E4S (v.8.8) gstreamer1-plugins-bad-free 1.16.1-3.el8_8
fixed: vendor fix RHSA-2025:8976
Red Hat Enterprise Linux AppStream E4S (v.9.0) gstreamer1-plugins-bad-free 1.18.4-7.el9_0
fixed: vendor fix RHSA-2025:8978
Red Hat Enterprise Linux AppStream E4S (v.9.2) gstreamer1-plugins-bad-free 1.18.4-8.el9_2
fixed: vendor fix RHSA-2025:8977
Red Hat Enterprise Linux AppStream EUS (v.9.4) gstreamer1-plugins-bad-free 1.22.1-5.el9_4
fixed: vendor fix RHSA-2025:8979
Red Hat Enterprise Linux AppStream TUS (v.8.6) gstreamer1-plugins-bad-free 1.16.1-3.el8_6
fixed: vendor fix RHSA-2025:9056
Red Hat Enterprise Linux AppStream TUS (v.8.8) gstreamer1-plugins-bad-free 1.16.1-3.el8_8
fixed: vendor fix RHSA-2025:8976
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) gstreamer1-plugins-bad-free-devel 1.22.12-4.el9_6, gstreamer1-plugins-bad-free-debuginfo 1.22.12-4.el9_6, gstreamer1-plugins-bad-free-debugsource 1.22.12-4.el9_6, gstreamer1-plugins-bad-free-libs-debuginfo 1.22.12-4.el9_6
fixed: vendor fix RHSA-2025:8183
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) gstreamer1-plugins-bad-free-devel 1.24.11-2.el10_0, gstreamer1-plugins-bad-free-debuginfo 1.24.11-2.el10_0, gstreamer1-plugins-bad-free-debugsource 1.24.11-2.el10_0, gstreamer1-plugins-bad-free-libs-debuginfo 1.24.11-2.el10_0
fixed: vendor fix RHSA-2025:8184
Red Hat Enterprise Linux CRB (v. 8) gstreamer1-plugins-bad-free-devel 1.16.1-5.el8_10, gstreamer1-plugins-bad-free-debuginfo 1.16.1-5.el8_10, gstreamer1-plugins-bad-free-debugsource 1.16.1-5.el8_10
fixed: vendor fix RHSA-2025:8201
Red Hat Enterprise Linux 7 gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free-gtk
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 17 mo ago (2025-05-22)

Exploit prediction

0.91% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

GStreamer GStreamer

Classification

Weakness

CWE-121 Stack-based Buffer Overflow
CWE-787 Out-of-bounds Write

References

zerodayinitiative.com /advisories/ZDI-25-267/
third-party-advisory
lists.debian.org /debian-lts-announce/2025/06/msg00017.html
mailing-list, third-party-advisory

Sources

CVE List CVE-2025-3887
NVD CVE-2025-3887

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary