Description
GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26596.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GStreamer | GStreamer | 2e8b542145c1b11f8b8d927f6c679fd8028ceb60 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gst-plugins-bad1.0 | 1.26.1-1 | — |
| Debian 13 | gst-plugins-bad1.0 | 1.26.1-1 | — |
| Debian 12 | gst-plugins-bad1.0 | 1.22.0-4+deb12u6 | DSA-5941-1 |
| Debian 11 | gst-plugins-bad1.0 | 1.18.4-3+deb11u5 | DLA-4219-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | gst-plugins-bad1.0 | 1.24.2-1ubuntu4+esm1 | USN-7558-1 |
| Ubuntu Pro 22.04 LTS | gst-plugins-bad1.0 | 1.20.3-0ubuntu1.1+esm2 | USN-7558-1 |
| Ubuntu Pro 20.04 LTS | gst-plugins-bad1.0 | 1.16.3-0ubuntu1.1+esm1 | USN-7558-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | gst-plugins-bad1.0 | 1.14.5-0ubuntu1~18.04.1+esm1 | — |
| Ubuntu Pro 16.04 LTS | gst-plugins-bad1.0 | 1.8.3-1ubuntu0.2+esm1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | gstreamer1-plugins-bad-free +2 | 1.24.11-2.el10_0 | RHSA-2025:8184 |
| RHEL 9 | gstreamer1-plugins-bad-free +2 | 1.22.12-4.el9_6 | RHSA-2025:8183 |
| RHEL 8 | gstreamer1-plugins-bad-free +1 | 1.16.1-5.el8_10 | RHSA-2025:8201 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | gstreamer1-plugins-bad-free +1 | 1.22.1-5.el9_4 | RHSA-2025:8979 |
| RHEL 9.2 E4S | gstreamer1-plugins-bad-free | 1.18.4-8.el9_2 | RHSA-2025:8977 |
| RHEL 9.0 E4S | gstreamer1-plugins-bad-free | 1.18.4-7.el9_0 | RHSA-2025:8978 |
| RHEL 8.8 TUS | gstreamer1-plugins-bad-free | 1.16.1-3.el8_8 | RHSA-2025:8976 |
| RHEL 8.8 E4S | gstreamer1-plugins-bad-free | 1.16.1-3.el8_8 | RHSA-2025:8976 |
| RHEL 8.6 TUS | gstreamer1-plugins-bad-free | 1.16.1-3.el8_6 | RHSA-2025:9056 |
| RHEL 8.6 E4S | gstreamer1-plugins-bad-free | 1.16.1-3.el8_6 | RHSA-2025:9056 |
| RHEL 8.6 AUS | gstreamer1-plugins-bad-free | 1.16.1-3.el8_6 | RHSA-2025:9056 |
| RHEL 8.4 AUS | gstreamer1-plugins-bad-free | 1.16.1-3.el8_4 | RHSA-2025:8980 |
| RHEL 8.2 AUS | gstreamer1-plugins-bad-free | 1.16.1-3.el8_2 | RHSA-2025:8981 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | gstreamer1-plugins-bad-free +2 | 1.24.11-2.el10_0 | ALSA-2025:8184 |
| AlmaLinux 9 | gstreamer1-plugins-bad-free +2 | 1.22.12-4.el9_6 | ALSA-2025:8183 |
| AlmaLinux 8 | gstreamer1-plugins-bad-free +1 | 1.16.1-5.el8_10 | ALSA-2025:8201 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | gstreamer1-plugins-bad-free | 1.24.11-2.el10_0 | RLSA-2025:8184 |
| Rocky Linux 9 | gstreamer1-plugins-bad-free | 1.22.12-4.el9_6 | RLSA-2025:8183 |
| Rocky Linux 8 | gstreamer1-plugins-bad-free | 1.16.1-5.el8_10 | RLSA-2025:8201 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | gstreamer-plugins-bad | 1.24.0-150600.4.3.1 | SUSE-SU-2025:01737-1 |
| SLES 15 SP6 | gstreamer-plugins-bad | 1.24.0-150600.4.3.1 | SUSE-SU-2025:01737-1 |
| SLES 15 SP5 | gstreamer-plugins-bad | 1.22.0-150500.3.28.1 | SUSE-SU-2025:01717-1 |
| SLES 15 SP4 | gstreamer-plugins-bad | 1.20.1-150400.3.26.1 | SUSE-SU-2025:01725-1 |
| SLES 15 SP3 | gstreamer-plugins-bad | 1.16.3-150300.9.21.1 | SUSE-SU-2025:01718-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | gstreamer-plugins-bad | 1.8.3-18.18.1 | SUSE-SU-2025:01729-1 |
| SLES for SAP 15 SP5 | gstreamer-plugins-bad | 1.22.0-150500.3.28.1 | SUSE-SU-2025:01717-1 |
| SLES for SAP 15 SP4 | gstreamer-plugins-bad | 1.20.1-150400.3.26.1 | SUSE-SU-2025:01725-1 |
| SLES for SAP 15 SP3 | gstreamer-plugins-bad | 1.16.3-150300.9.21.1 | SUSE-SU-2025:01718-1 |
| SLE HPC 15 SP5 | gstreamer-plugins-bad | 1.22.0-150500.3.28.1 | SUSE-SU-2025:01717-1 |
| SLE HPC 15 SP4 | gstreamer-plugins-bad | 1.20.1-150400.3.26.1 | SUSE-SU-2025:01725-1 |
| SLE HPC 15 SP3 | gstreamer-plugins-bad | 1.16.3-150300.9.21.1 | SUSE-SU-2025:01718-1 |
| SUSE Manager Server 4.3 | gstreamer-plugins-bad | 1.20.1-150400.3.26.1 | SUSE-SU-2025:01725-1 |
| SUSE Manager Proxy 4.3 | gstreamer-plugins-bad | 1.20.1-150400.3.26.1 | SUSE-SU-2025:01725-1 |
| SUSE Enterprise Storage 7.1 | gstreamer-plugins-bad | 1.16.3-150300.9.21.1 | SUSE-SU-2025:01718-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | gst-plugins-bad | 1.26.1-r0 | — |
| Alpine v3.23 | gst-plugins-bad | 1.26.1-r0 | — |
| Alpine v3.22 | gst-plugins-bad | 1.26.1-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | gstreamer1-plugins-bad-free +2 | 1.24.11-2.el10_0 | ELSA-2025-8184 |
| Oracle Linux 9 | gstreamer1-plugins-bad-free +2 | 1.22.12-4.el9_6 | ELSA-2025-8183 |
| Oracle Linux 8 | gstreamer1-plugins-bad-free +1 | 1.16.1-5.0.1.el8_10 | ELSA-2025-8201 |
Advisories 28
- ALSA-2025:8184 Important: gstreamer1-plugins-bad-free security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:8183 Important: gstreamer1-plugins-bad-free security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:8201 Important: gstreamer1-plugins-bad-free security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:9056 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8981 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8979 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8980 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8977 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8978 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8976 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8201 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8183 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8184 Red Hat Security Advisory: gstreamer1-plugins-bad-free security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- WID-SEC-2025-0885 GStreamer: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jul 9, 2026
- USN-7558-1 gst-plugins-bad1.0 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- SUSE-SU-2025:01737-1 Security update for gstreamer-plugins-bad SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:01725-1 Security update for gstreamer-plugins-bad SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:01717-1 Security update for gstreamer-plugins-bad SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:01718-1 Security update for gstreamer-plugins-bad SUSE / openSUSE Security Updates · Mar 23, 2026
- DSA-5941-1 gst-plugins-bad1.0 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4219-1 gst-plugins-bad1.0 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2025:01729-1 Security update for gstreamer-plugins-bad SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2025:8183 Important: gstreamer1-plugins-bad-free security update Rocky Linux Security Advisories · Oct 4, 2025
- RLSA-2025:8184 Important: gstreamer1-plugins-bad-free security update Rocky Linux Security Advisories · Oct 3, 2025
- RLSA-2025:8201 Important: gstreamer1-plugins-bad-free security update Rocky Linux Security Advisories · Jul 29, 2025
- ELSA-2025-8184 Important: gstreamer1-plugins-bad-free security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jun 27, 2025
- ELSA-2025-8183 Important: gstreamer1-plugins-bad-free security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 27, 2025
- ELSA-2025-8201 Important: gstreamer1-plugins-bad-free security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 27, 2025