Buffer Overflow Vulnerability in GStreamer gst-plugins-base Package
Summary
ALPINE-CVE-2025-47806: In GStreamer through 1.26.1, the subparse plugin's parse_subrip_time function may write data past the bounds of a stack buffer, leading to a crash. Affects gst-plugins-base versions < 1.26.2-r0. Fixed in 1.26.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GStreamer is a powerful multimedia framework that allows the construction of graphs of media-handling components. The gst-plugins-base package provides a set of essential plugins for GStreamer, enabling various media formats and functionalities. However, vulnerabilities in these plugins can lead to severe security issues, including crashes and potential exploitation.
Vulnerability Detail
In GStreamer versions up to 1.26.1, the subparse plugin's parse_subrip_time function contains a flaw that allows it to write data beyond the bounds of a stack buffer. This buffer overflow can lead to crashes and may potentially be exploited by attackers to execute arbitrary code, compromising the integrity and availability of the application.
How To Fix
Minimum fixed version
1.26.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade gst-plugins-baseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider disabling the subparse plugin temporarily to mitigate the risk of exploitation until a proper update can be applied.
Conclusion
The buffer overflow vulnerability in the GStreamer gst-plugins-base package poses significant risks to applications using this multimedia framework. It is crucial to update to the patched version to safeguard against potential exploits. Additionally, utilizing tools like Vulert can help maintain awareness of vulnerabilities in your software.
See every vulnerability recorded for gst-plugins-base →
FAQ
The vulnerability is a buffer overflow in the parse_subrip_time function of the subparse plugin in GStreamer.
Exploitation of this vulnerability can lead to application crashes and may allow attackers to execute arbitrary code.
Yes, the vulnerability is fixed in version 1.26.2-r0 of the gst-plugins-base package.
You can disable the subparse plugin as a temporary workaround to reduce the risk of exploitation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can also check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for gst-plugins-base.
