Critical NULL Pointer Dereference in GStreamer gst-plugins-base Package
Summary
CVE-2025-47808: In GStreamer through 1.26.1, the subparse plugin's tmplayer_parse_line function may dereference a NULL pointer while parsing a subtitle file, leading to a crash. Affects gst-plugins-base across 2 version ranges.
< 1.26.2-r0
< 100c21e1faf68efe7f3830b6e9f856760697ab48
Fixed in 1.26.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GStreamer is a powerful multimedia framework used for constructing graphs of media-handling components. The gst-plugins-base package provides a set of essential plugins for GStreamer, enabling various media formats and functionalities. This package is widely utilized in applications that require audio and video processing. However, a vulnerability has been identified in the subparse plugin of gst-plugins-base, which can lead to application crashes when handling subtitle files.
Vulnerability Detail
In GStreamer versions up to 1.26.1, the tmplayer_parse_line function within the subparse plugin may dereference a NULL pointer while parsing subtitle files. This flaw can result in a crash of the application using the GStreamer framework, potentially leading to denial of service. The vulnerability arises from improper handling of input data, which can be exploited by malicious subtitle files.
How To Fix
Minimum fixed version
1.26.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade gst-plugins-baseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using subtitle files that may be malformed or untrusted until the package is updated. Implementing input validation on subtitle files can also help mitigate the risk of triggering this vulnerability.
Conclusion
The CVE-2025-47808 vulnerability in the GStreamer gst-plugins-base package poses a significant risk due to potential application crashes from NULL pointer dereferences. Users are strongly advised to update their packages to the latest versions to mitigate this risk. Utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for gst-plugins-base →
FAQ
CVE-2025-47808 is a vulnerability in the GStreamer gst-plugins-base package that can cause a NULL pointer dereference, leading to application crashes when parsing subtitle files.
You can use Vulert, a tool that monitors open-source vulnerabilities, to check if your application is affected by CVE-2025-47808. Simply upload your manifest file like package-lock.json to the Vulert playground.
The vulnerability can lead to application crashes, resulting in denial of service for users relying on GStreamer for media playback.
Yes, a patch is available in version 1.26.2-r0 for Alpine and 1.26.2-1 for Debian-based systems. It is recommended to update to these versions.
If immediate updates are not possible, avoid using potentially malicious subtitle files and implement input validation to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for gst-plugins-base.
