Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 116

CVE-2025-3887

GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of H265 slice headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26596.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Gstreamer Redhat
Products
Debian Linux Gstreamer Enterprise Linux and 4 more
CVE-2016-10199

gstreamer-plugins-good: Out of bounds read in qtdemux_tag_add_str_full

The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted tag value.

CVSS 3.0 · 7.5 High EPSS 4.8% KEV · Not listed
Vendors
Gstreamer Redhat
Products
Gstreamer Enterprise Linux
CVE-2017-5848

gstreamer-plugins-bad-free: Invalid memory read in gst_ps_demux_parse_psm

The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors involving PSM parsing.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed
Vendors
Debian Gstreamer Redhat
Products
Debian Linux Gstreamer Enterprise Linux and 6 more
CVE-2025-6663

GStreamer H266 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

GStreamer H266 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of H266 sei messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27381.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gstreamer
Products
Gstreamer
CVE-2017-5837

gstreamer-plugins-base: Floating point exception in gst_riff_create_audio_caps

The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted video file.

CVSS 3.0 · 5.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Gstreamer Redhat
Products
Gstreamer Enterprise Linux
CVE-2017-5844

gstreamer-plugins-base: Floating point exception in gst_riff_create_audio_caps

The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (floating point exception and crash) via a crafted ASF file.

CVSS 3.0 · 5.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Gstreamer Redhat
Products
Gstreamer Enterprise Linux
CVE-2016-9813

gstreamer-plugins-bad-free: NULL pointer dereference in mpegts parser

The _parse_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.

CVSS 3.0 · 5.5 Medium EPSS 7.9% KEV · Not listed
Vendors
Gstreamer Redhat
Products
Gstreamer Enterprise Linux
CVE-2016-9811

gstreamer: Out of bounds heap read in windows_icon_typefind

The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to always-malloc, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ico file.

CVSS 3.1 · 4.7 Medium EPSS 2.3% KEV · Not listed
Vendors
Debian Fedoraproject Gstreamer and 1 more
Products
Debian Linux Fedora Gstreamer and 7 more
CVE-2016-9807

gstreamer-plugins-good: Invalid memory read in flx_decode_chunks

The flx_decode_chunks function in gst/flx/gstflxdec.c in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted FLIC file.

CVSS 3.0 · 5.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Gstreamer Redhat
Products
Gstreamer Enterprise Linux
CVE-2016-9636

gstreamer-plugins-good: Heap buffer overflow in FLIC decoder

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by providing a 'write count' that goes beyond the initialized buffer.

CVSS 3.0 · 9.8 Critical EPSS 8.3% KEV · Not listed
Vendors
Debian Gstreamer Redhat
Products
Debian Linux Gstreamer Enterprise Linux and 4 more
CVE-2016-9635

gstreamer-plugins-good: Heap buffer overflow in FLIC decoder

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by providing a 'skip count' that goes beyond initialized buffer.

CVSS 3.0 · 9.8 Critical EPSS 8.8% KEV · Not listed
Vendors
Debian Gstreamer Redhat
Products
Debian Linux Gstreamer Enterprise Linux and 4 more
CVE-2016-9810

gstreamer: Invalid memory read in g_type_check_instance_is_fundamentally_a

The gst_decode_chain_free_internal function in the flxdex decoder in gst-plugins-good in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and crash) via an invalid file, which triggers an incorrect unref call.

CVSS 3.0 · 5.5 Medium EPSS 2.4% KEV · Not listed
Vendors
Gstreamer Redhat
Products
Gstreamer Enterprise Linux
CVE-2016-9809

gstreamer-plugins-bad-free: Off-by-one read in gst_h264_parse_set_caps

Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via a crafted file, which triggers an out-of-bounds read.

CVSS 3.0 · 7.8 High EPSS 2.9% KEV · Not listed
Vendors
Gstreamer Redhat
Products
Gstreamer Enterprise Linux
CVE-2016-9808

gstreamer-plugins-good: Heap buffer overflow in FLIC decoder

The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted series of skip and count pairs.

CVSS 3.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Gstreamer Redhat
Products
Gstreamer Enterprise Linux
CVE-2016-9812

gstreamer1-plugins-bad-free: Out-of-bounds read in gst_mpegts_section_new

The gst_mpegts_section_new function in the mpegts decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a too small section.

CVSS 3.0 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Gstreamer Redhat
Products
Gstreamer Enterprise Linux
CVE-2016-9634

gstreamer-plugins-good: Heap buffer overflow in FLIC decoder

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via the start_line parameter.

CVSS 3.0 · 9.8 Critical EPSS 8.8% KEV · Not listed
Vendors
Debian Gstreamer Redhat
Products
Debian Linux Gstreamer Enterprise Linux and 4 more