High
Security advisory
In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-47219
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 17:32 UTC · Revision 1
Source evidence
In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.
osv:CVE-2025-47219
Complete source record
{
"id": "7448c8b73538ef33b61f53d6552ab42930864f0675e93a0cb3db26b27d091b75",
"url": "https://osv.dev/vulnerability/CVE-2025-47219",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2025-47219",
"summary": "In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.",
"evidence": "osv:CVE-2025-47219",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2025-47219",
"aliases": [
"BIT-java-2025-47219",
"BIT-java-min-2025-47219",
"BIT-jre-2025-47219",
"CVE-2025-47219"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/gstreamer/gstreamer",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "100c21e1faf68efe7f3830b6e9f856760697ab48"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.26.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"1.26.1",
"1.26.0",
"1.25.90",
"1.25.50",
"1.25.1",
"1.24.0",
"1.23.90",
"1.23.2",
"1.23.1",
"1.22.0",
"1.21.90",
"1.21.3",
"1.21.2",
"1.21.1",
"1.20.0",
"1.19.90",
"1.19.3",
"monorepo-start",
"1.19.2",
"1.19.1",
"1.18.0",
"1.17.90",
"1.17.2",
"1.17.1",
"1.16.0",
"1.15.90",
"1.15.2",
"1.15.1",
"1.14.0",
"1.13.91",
"1.13.90",
"1.13.1",
"1.12.0",
"1.11.91",
"1.11.90",
"1.11.2",
"1.11.1",
"1.10.0",
"1.11.0",
"1.9.90",
"1.9.2",
"1.9.1",
"1.8.0",
"1.7.91",
"1.7.90",
"1.7.2",
"1.7.1",
"1.6.0",
"1.5.91",
"1.5.90",
"1.5.2",
"1.5.1",
"1.4.0",
"1.3.91",
"1.3.90",
"1.3.3",
"1.3.2",
"1.3.1",
"1.2.0",
"1.1.90",
"1.1.4",
"1.1.3",
"1.1.2",
"1.1.1",
"1.0.2",
"1.0.1",
"1.0.0",
"RELEASE-0.11.99",
"RELEASE-0.11.94",
"RELEASE-0.11.93",
"RELEASE-0.11.92",
"RELEASE-0.11.91",
"RELEASE-0.11.90",
"RELEASE-0.11.2",
"RELEASE-0.11.1",
"RELEASE-0.11.0",
"RELEASE-0.10.31",
"RELEASE-0.10.30",
"RELEASE-0.10.29",
"RELEASE-0.10.28",
"RELEASE-0.10.27",
"RELEASE-0.10.26",
"RELEASE-0.10.25",
"RELEASE-0.10.24",
"RELEASE-0.10.23",
"RELEASE-0_10_22",
"GIT_CONVERSION",
"RELEASE-0_10_21",
"RELEASE-0_10_20",
"RELEASE-0_10_18",
"RELEASE-0_10_17",
"RELEASE-0_10_16",
"RELEASE-0_10_15",
"RELEASE-0_10_14",
"RELEASE-0_10_13",
"RELEASE-0_10_12",
"RELEASE-0_10_11",
"RELEASE-0_10_10",
"RELEASE-0_10_9",
"RELEASE-0_10_8",
"RELEASE-0_10_7",
"RELEASE-0_10_6",
"RELEASE-0_10_5",
"RELEASE-0_10_4",
"RELEASE-0_10_3",
"RELEASE-0_10_2",
"RELEASE-0_10_1",
"RELEASE-0_10_0",
"RELEASE-0_9_7",
"RELEASE-0_9_6",
"RELEASE-0_9_5",
"RELEASE-0_9_4",
"RELEASE-0_9_3",
"RELEASE-0_9_2",
"CHANGELOG_START",
"BRANCH-GSTREAMER-0_8-ROOT",
"BRANCH-GSTREAMER-0_6-ROOT",
"RELEASE-0_8_9",
"RELEASE-0_8_8",
"RELEASE-0_8_7",
"RELEASE-0_8_6",
"RELEASE-0_8_4",
"RELEASE-0_8_3",
"RELEASE-0_8_2",
"RELEASE-0_8_1",
"RELEASE-0_8_0",
"BEFORE_INDENT",
"RELEASE-0_7_6",
"BRANCH-RELEASE-0_7_5-ROOT",
"BRANCH-RELEASE-0_7_4-ROOT",
"RELEASE-0_7_3",
"MOVE-TO-FDO",
"CAPS-MERGE-3",
"CAPS-MERGE-2",
"CAPS-MERGE-1",
"RELEASE-0_7_2",
"BRANCH-RELEASE-0_7_2-ROOT",
"CAPS-ROOT",
"TYPEFIND-ROOT",
"RELEASE-0_7_1",
"BRANCH-ERROR-ROOT",
"OSLOSUMMIT1-200303051",
"BRANCH-RELEASE-0_5_2-ROOT",
"BRANCH-RELEASE-0_5_1-ROOT",
"BRANCH-RELEASE-0_5_0-ROOT",
"BRANCH-RELEASE-0_4_2-ROOT",
"BRANCH-RELEASE-0_4_1-ROOT",
"BRANCH-RELEASE-0_4_0-ROOT",
"BRANCH-RELEASE-0_3_4-ROOT",
"BRANCH-RELEASE-0_3_3-ROOT",
"BRANCH-EVENTS2-ROOT",
"start",
"RELEASE-0_3_2-DOBDAY",
"DEBIAN-0_3_1-1",
"RELEASE-0_3_1-BELGIANBEER",
"BRANCH-BUILD1-20011216-FREEZE",
"RELEASE-0_3_0-EVENTFUL",
"BRANCH-BUILD1-200112101-ROOT",
"BRANCH-BUILD1-200112061-ROOT",
"BRANCH-BUILD1-ROOT",
"EVENTS1-200110161-FREEZE",
"BRANCH-EVENTS1-200110161-ROOT",
"BRANCH-EVENTS1-ROOT",
"RELEASE-0_2_1-UNKN",
"RELEASE-0_2_1-SEDIMASTER",
"GOBJECT1-200106241",
"GOBJECT1-200106241-FREEZE",
"BRANCH-GOBJECT1-200106241-ROOT",
"RELEASE-0_2_0-CRITICALMASS",
"BRANCH-GOBJECT1-ROOT",
"INCSCHED1-200105251",
"INCSCHED1-200105251-FREEZE",
"BRANCH-INCSCHED1-200105251-ROOT",
"BRANCH-INCSCHED1-200105231-ROOT",
"BRANCH-INCSCHED1-200104251-ROOT",
"PLUGINVER1-20010422",
"PLUGINVER1-20010422-FREEZE",
"BRANCH-PLUGINVER1-20010422-ROOT",
"BRANCH-PLUGINVER1-ROOT",
"BRANCH-INCSCHED1-200104161-ROOT",
"HEAD-20010312-PRE_CAPSNEGO1",
"HEAD-20010306-PRE_AUTOPLUG2",
"RELEASE-0_1_1-DUCTTAPE",
"BRANCH-CAPSNEGO1-ROOT",
"BRANCH-INCSCHED1-ROOT",
"BRANCH-AUTOPLUG2-ROOT",
"RELEASE-0_1_0-SLIPSTREAM"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-47219.json"
}
}
],
"modified": "2026-10-28T02:30:21.585338649Z",
"provider": "osv",
"references": [
"https://cert-portal.siemens.com/productcert/html/ssa-032379.html",
"https://gstreamer.freedesktop.org/security/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47219.json",
"https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md",
"https://nvd.nist.gov/vuln/detail/CVE-2025-47219"
],
"provider_metadata": {
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47219.json"
}
},
"related_cves": [
{
"value": "CVE-2025-47219",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 487839,
"published_at": "2025-08-07T00:00:00+00:00"
}