# Security Advisory 2025-0004 (CVE-2025-47219)

<div class="vertical-table">

|                   |     |
| ----------------- | --- |
| Summary           | Out-of-bounds read in MOV/MP4 demuxer|
| Date              | 2025-05-29 23:30 |
| Affected Versions | GStreamer gst-plugins-good < 1.26.2 |
| IDs               | GStreamer-SA-2025-0004<br/>CVE-2025-47219 |

</div>

## Details

An Out-of-bounds read in the MOV/MP4 demuxer that can cause crashes or
potentially information leaks for certain input files.

## Impact

It is possible for a malicious third party to trigger an Out-of-bounds read
that can result in a crash of the application or potentially information leaks.

## Solution

The gst-plugins-good 1.26.2 release addresses the issue.

People using older versions of GStreamer should either upgrade or apply the
minimal patch and recompile.

Note that the minimal patch is not included in the 1.26.2 release in that form
since this issue was solved independently [in a different way][MR-8929] as part
of a bigger refactoring that solved this and many other issues.

[MR-8929]: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8929

## References

### The GStreamer project

- [https://gstreamer.freedesktop.org](https://gstreamer.freedesktop.org)

### CVE Database Entries

- [CVE-2025-47219](https://www.cve.org/CVERecord?id=CVE-2025-47219)

### GStreamer releases

#### 1.26 (current stable)

- [GStreamer 1.26.2 release notes](/releases/1.26/#1.26.2)
- [GStreamer Plugins Good 1.26.2](/src/gst-plugins-good/gst-plugins-good-1.26.2.tar.xz)

### Patches

- [Patch for 1.26.1 and earlier versions](https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9137.patch)