Heap-based buffer overflow in GStreamer
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 fixed, 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.
Summary
DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the matroskaparse element has no size checks.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | GStreamer | 1.20.3 | — | No fix listed | CNA |
- GStreamer Vendor— Affected 1.20.3 Fixed in — No fix listed CNA
Remediation
Red Hat 1 advisory
- RHSA-2023:2260 Released 2023-05-09 · Red Hat rating Moderategstreamer1-plugins-good security update
- Red Hat Enterprise Linux AppStream (v. 9) gstreamer1-plugins-good-1.18.4-6.el9, gstreamer1-plugins-good-gtk-1.18.4-6.el9
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
GStreamer — DSA-5204
7 records Highest priority Priority LOW 7 LOW
Other records, highest priority first
- TI-2022-01780 Integer overflow in GStreamerPriority LOW 35
- TI-2022-01779 Heap-based buffer overflow in GStreamerPriority LOW 35
- TI-2022-01963 Heap-based buffer overflow in GStreamerPriority LOW 34
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:2260 |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1925
- 2026-10-03 Alias added: GHSA-v6c6-gcwr-p5pm
References
Sources
- CVE-2022-1925 · CVE Program
- CVE-2022-1925 · NVD
- FIRST EPSS
- GHSA-v6c6-gcwr-p5pm · GitHub Advisory Database · CC BY 4.0
- CVE-2022-1925 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences