CVE-2025-6663 Details
Description
GStreamer H266 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of H266 sei messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27381.
A stack-based buffer overflow vulnerability allowing remote code execution has been identified in GStreamer, specifically within the H266 codec parsing. The issue arises from improper validation of the length of user-supplied data in H266 sei messages, leading to arbitrary code execution in the context of the current process. This vulnerability requires interaction with the GStreamer library to exploit, and the attack vectors may vary depending on the implementation.
GStreamer has released a patch for this vulnerability. Users can refer to the GStreamer GitLab repository for the updated version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 7, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gstreamer gstreamer | >= 1.26.0, < 1.26.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 17, 2026 | CPE Deprecation Remap | [email protected] |
| Aug 14, 2025 | Initial Analysis | [email protected] |
| Jul 7, 2025 | New CVE Received | [email protected] |