Security Advisory 2025-0007 (CVE-2025-6663, ZDI-CAN-27381)
|
|
| Summary |
Stack buffer overflow in H.266 video parser |
| Date |
2025-06-26 18:00 |
| Affected Versions |
GStreamer gst-plugins-bad >= 1.26.0, < 1.26.3 |
| IDs |
GStreamer-SA-2025-0007
CVE-2025-6663
ZDI-CAN-27381 |
Details
A buffer overflow in the H.266 video bitstream parser that can cause crashes
for certain input files, and could possibly also allow code execution
through stack manipulation.
Impact
It is possible for a malicious third party to trigger a buffer overflow
that can result in a crash of the application and possibly also allow code
execution through stack manipulation.
Solution
The gst-plugins-bad 1.26.3 release addresses the issue. People using older
1.26.x versions of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
GStreamer releases
1.26 (current stable)
Patches
