GS
Product
GStreamer
112
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 20High 72Medium 18Low 0
Watch
Add GStreamer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-2920 | 7.8 | Mar 13 | GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability Affected: 1c6e163aa33962f5ee4a87d29319ccdd5cb67612 |
| CVE-2025-6663 | 7.8 | Jul 7 | GStreamer H266 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability Affected: 1.26.0 before 1.26.3 |
| CVE-2025-2759 | 7.8 | May 22 | GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability Affected: before 1.25.1 |
| CVE-2024-4453 | 7.8 | May 22 | GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability Affected: 1.24.0; 1.24.1 |
| CVE-2022-2122 | 7.8 | Jul 19 | DOS / potential heap overwrite in qtdemux using zlib decompression Affected: before 1.20.3 |
| CVE-2022-1925 | 7.8 | Jul 19 | DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression Affected: before 1.20.3 |
| CVE-2022-1924 | 7.8 | Jul 19 | DOS / potential heap overwrite in mkv demuxing using lzo decompression Affected: before 1.20.3 |
| CVE-2022-1923 | 7.8 | Jul 19 | DOS / potential heap overwrite in mkv demuxing using bzip decompression Affected: before 1.20.3 |
| CVE-2022-1922 | 7.8 | Jul 19 | DOS / potential heap overwrite in mkv demuxing using zlib decompression Affected: before 1.20.3 |
| CVE-2022-1921 | 7.8 | Jul 19 | Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while parsing avi files Affected: before 1.20.3 |
| CVE-2022-1920 | 7.8 | Jul 19 | Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a heap overwrite while parsing matroska files Affected: before 1.20.3 |
| CVE-2021-3498 | 7.8 | Apr 19 | GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files Affected: 1.0.0 before 1.18.4 |
| CVE-2021-3497 | 7.8 | Apr 19 | GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files Affected: 0.10.0 before 1.18.4 |
| CVE-2016-9447 | 7.8 | Jan 23 | The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) and possibly execute arbitrary code via a… Affected: 0.10.0; 0.10.1; 0.10.2; 0.10.3; 0.10.4; 0.10.5; +31 more |
| CVE-2016-9809 | 7.8 | Jan 13 | Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via a crafted file, which triggers an… Affected: through 1.10.1 |
| CVE-2026-1940 | 7.5 | Mar 23 | Gstreamer: incomplete fix of cve-2026-1940 Affected: before 1.28.1 |
| CVE-2024-47835 | 7.5 | Dec 12 | GStreamer is a library for constructing graphs of media-handling components Affected: before 1.24.10 |
| CVE-2024-47778 | 7.5 | Dec 12 | GStreamer is a library for constructing graphs of media-handling components Affected: before 1.24.10 |
| CVE-2024-47603 | 7.5 | Dec 12 | GStreamer is a library for constructing graphs of media-handling components Affected: before 1.24.10 |
| CVE-2024-47602 | 7.5 | Dec 12 | GStreamer is a library for constructing graphs of media-handling components Affected: before 1.24.10 |
| CVE-2024-47601 | 7.5 | Dec 12 | GStreamer is a library for constructing graphs of media-handling components Affected: before 1.24.10 |
| CVE-2024-47599 | 7.5 | Dec 12 | GStreamer is a library for constructing graphs of media-handling components Affected: before 1.24.10 |
| CVE-2024-47596 | 7.5 | Dec 12 | GStreamer is a library for constructing graphs of media-handling components Affected: before 1.24.10 |
| CVE-2024-47546 | 7.5 | Dec 12 | GStreamer is a library for constructing graphs of media-handling components Affected: before 1.24.10 |
| CVE-2024-47545 | 7.5 | Dec 12 | GStreamer is a library for constructing graphs of media-handling components Affected: before 1.24.10 |
| CVE-2024-47544 | 7.5 | Dec 12 | GStreamer is a library for constructing graphs of media-handling components Affected: before 1.24.10 |
| CVE-2024-47543 | 7.5 | Dec 12 | GStreamer is a library for constructing graphs of media-handling components Affected: before 1.24.10 |
| CVE-2024-47542 | 7.5 | Dec 12 | GStreamer is a library for constructing graphs of media-handling components Affected: before 1.24.10 |
| CVE-2024-47541 | 7.5 | Dec 12 | GStreamer is a library for constructing graphs of media-handling components Affected: before 1.24.10 |
| CVE-2017-5848 | 7.5 | Feb 9 | The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (invalid memory read and… Affected: before 1.11.2 |
| CVE-2017-5847 | 7.5 | Feb 9 | The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service… Affected: before 1.11.2 |
| CVE-2017-5845 | 7.5 | Feb 9 | The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory… Affected: through 1.10.2 |
| CVE-2017-5843 | 7.5 | Feb 9 | Multiple use-after-free vulnerabilities in the (1) gst_mini_object_unref, (2) gst_tag_list_unref, and (3) gst_mxf_demux_update_essence_tracks functions in GStreamer before 1.10.3… Affected: through 1.10.2 |
| CVE-2017-5841 | 7.5 | Feb 9 | The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds… Affected: through 1.10.2 |
| CVE-2017-5840 | 7.5 | Feb 9 | The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap… Affected: through 1.10.2 |
| CVE-2017-5839 | 7.5 | Feb 9 | The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, which allows remote… Affected: through 1.10.2 |
| CVE-2017-5838 | 7.5 | Feb 9 | The gst_date_time_new_from_iso8601_string function in gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds heap read)… Affected: through 1.10.2 |
| CVE-2016-10199 | 7.5 | Feb 9 | The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds… Affected: through 1.10.2 |
| CVE-2016-9446 | 7.5 | Jan 23 | The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1… Affected: before 1.11.1 |
| CVE-2016-9445 | 7.5 | Jan 23 | Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service (crash) via large width and height values, which triggers a buffer… Affected: 1.10.0 |
| CVE-2016-9812 | 7.5 | Jan 13 | The gst_mpegts_section_new function in the mpegts decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a too small… Affected: through 1.10.1 |
| CVE-2016-9808 | 7.5 | Jan 13 | The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted series of skip and count pairs Affected: through 1.10.1 |
| CVE-2026-73433 | 6.6 | Aug 12 | Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write Affected: through 1.28.6 |
| CVE-2025-47183 | 6.6 | Aug 7 | In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure Affected: before 1.26.2 |
| CVE-2026-73434 | 6.1 | Aug 12 | Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing Affected: before 1.28.6 |
| CVE-2025-47806 | 5.6 | Aug 7 | In GStreamer through 1.26.1, the subparse plugin's parse_subrip_time function may write data past the bounds of a stack buffer, leading to a crash Affected: before 1.26.2 |
| CVE-2025-47808 | 5.6 | Aug 7 | In GStreamer through 1.26.1, the subparse plugin's tmplayer_parse_line function may dereference a NULL pointer while parsing a subtitle file, leading to a crash Affected: before 1.26.2 |
| CVE-2025-47807 | 5.5 | Aug 7 | In GStreamer through 1.26.1, the subparse plugin's subrip_unescape_formatting function may dereference a NULL pointer while parsing a subtitle file, leading to a crash Affected: before 1.26.2 |
| CVE-2021-3522 | 5.5 | Jun 2 | GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags Affected: before 1.18.4 |
| CVE-2017-5846 | 5.5 | Feb 9 | The gst_asf_demux_process_ext_stream_props function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer before 1.10.3 allows remote attackers to cause a denial of… Affected: through 1.10.2 |