Every CVE whose affected-product data names Gstreamer, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (110)
CVE-2016-9634 — CVSS 9.8 (critical): Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2…
CVE-2016-9636 — CVSS 9.8 (critical): Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2…
CVE-2024-47615 — CVSS 9.8 (critical): GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function…
CVE-2024-47613 — CVSS 9.8 (critical): GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been identified…
CVE-2024-47607 — CVSS 9.8 (critical): GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the…
CVE-2024-47606 — CVSS 9.8 (critical): GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function…
CVE-2024-47540 — CVSS 9.8 (critical): GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been…
CVE-2024-47539 — CVSS 9.8 (critical): GStreamer is a library for constructing graphs of media-handling components. An out-of-bounds write vulnerability was identified in the…
CVE-2024-47538 — CVSS 9.8 (critical): GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the…
CVE-2024-47537 — CVSS 9.8 (critical): GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by…
CVE-2016-9635 — CVSS 9.8 (critical): Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2…
CVE-2024-47598 — CVSS 9.1 (critical): GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in the…
CVE-2024-47597 — CVSS 9.1 (critical): GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function…
CVE-2024-47774 — CVSS 9.1 (critical): GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the…
CVE-2024-47775 — CVSS 9.1 (critical): GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been found in the parse_ds64…
CVE-2024-47834 — CVSS 9.1 (critical): GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered…
CVE-2024-47776 — CVSS 9.1 (critical): GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in gst_wavparse_cue_chunk…
CVE-2024-47600 — CVSS 9.1 (critical): GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the…
CVE-2024-47777 — CVSS 9.1 (critical): GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the…
CVE-2019-9928 — CVSS 8.8 (high): GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server, potentially…
CVE-2025-47219 — CVSS 8.1 (high): In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4…
CVE-2026-18299 — CVSS 7.8 (high): GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary…
CVE-2016-9447 — CVSS 7.8 (high): The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write)…
CVE-2016-9809 — CVSS 7.8 (high): Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via…
CVE-2021-3497 — CVSS 7.8 (high): GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.
CVE-2021-3498 — CVSS 7.8 (high): GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
CVE-2022-1920 — CVSS 7.8 (high): Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a heap overwrite while parsing…
CVE-2022-1921 — CVSS 7.8 (high): Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while parsing avi files. Potential for…
CVE-2022-1922 — CVSS 7.8 (high): DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux element in…
CVE-2022-1923 — CVSS 7.8 (high): DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux element in bzip decompression…
CVE-2022-1924 — CVSS 7.8 (high): DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux element in lzo decompression…
CVE-2022-1925 — CVSS 7.8 (high): DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in matroskaparse element in…
CVE-2022-2122 — CVSS 7.8 (high): DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in qtdemux_inflate function which…
CVE-2025-2759 — CVSS 7.8 (high): GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate…
CVE-2024-47596 — CVSS 7.5 (high): GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in the qtdemux_parse_svq3_stsd_…
CVE-2017-5841 — CVSS 7.5 (high): The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to…
CVE-2017-5840 — CVSS 7.5 (high): The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause…
CVE-2024-47599 — CVSS 7.5 (high): GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered…
CVE-2017-5839 — CVSS 7.5 (high): The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly…
CVE-2024-47601 — CVSS 7.5 (high): GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered…
CVE-2024-47602 — CVSS 7.5 (high): GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered…
CVE-2024-47603 — CVSS 7.5 (high): GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered…
CVE-2017-5838 — CVSS 7.5 (high): The gst_date_time_new_from_iso8601_string function in gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attackers to cause a…
CVE-2016-9812 — CVSS 7.5 (high): The gst_mpegts_section_new function in the mpegts decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service…
CVE-2016-9808 — CVSS 7.5 (high): The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a…
CVE-2024-47778 — CVSS 7.5 (high): GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in…
CVE-2016-9446 — CVSS 7.5 (high): The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as…
CVE-2024-47835 — CVSS 7.5 (high): GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in…
CVE-2009-0586 — CVSS 7.5 (high): Integer overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag.c) in vorbistag in gst-plugins-base (aka…
CVE-2016-9445 — CVSS 7.5 (high): Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service (crash) via large width and…
CVE-2016-10199 — CVSS 7.5 (high): The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to…
CVE-2017-5848 — CVSS 7.5 (high): The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a…
CVE-2017-5847 — CVSS 7.5 (high): The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers…
CVE-2017-5845 — CVSS 7.5 (high): The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to…
CVE-2017-5843 — CVSS 7.5 (high): Multiple use-after-free vulnerabilities in the (1) gst_mini_object_unref, (2) gst_tag_list_unref, and (3) gst_mxf_demux_update_essence_track…
CVE-2024-47541 — CVSS 7.5 (high): GStreamer is a library for constructing graphs of media-handling components. An OOB-write vulnerability has been identified in the…
CVE-2024-47542 — CVSS 7.5 (high): GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference has been discovered in the…
CVE-2024-47543 — CVSS 7.5 (high): GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in…
CVE-2024-47544 — CVSS 7.5 (high): GStreamer is a library for constructing graphs of media-handling components. The function qtdemux_parse_sbgp in qtdemux.c is affected by a…
CVE-2024-47545 — CVSS 7.5 (high): GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in qtdemux_parse_trak…
CVE-2024-47546 — CVSS 7.5 (high): GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in extract_cc_from_data…
CVE-2015-0797 — CVSS 6.8 (medium): GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows…
CVE-2026-73433 — CVSS 6.6 (medium): A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd()…
CVE-2025-47183 — CVSS 6.6 (medium): In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4…
CVE-2026-73434 — CVSS 6.1 (medium): A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available…
CVE-2025-47806 — CVSS 5.6 (medium): In GStreamer through 1.26.1, the subparse plugin's parse_subrip_time function may write data past the bounds of a stack buffer, leading to…
CVE-2025-47808 — CVSS 5.6 (medium): In GStreamer through 1.26.1, the subparse plugin's tmplayer_parse_line function may dereference a NULL pointer while parsing a subtitle…
CVE-2016-9810 — CVSS 5.5 (medium): The gst_decode_chain_free_internal function in the flxdex decoder in gst-plugins-good in GStreamer before 1.10.2 allows remote attackers to…
CVE-2025-47807 — CVSS 5.5 (medium): In GStreamer through 1.26.1, the subparse plugin's subrip_unescape_formatting function may dereference a NULL pointer while parsing a…
CVE-2016-9807 — CVSS 5.5 (medium): The flx_decode_chunks function in gst/flx/gstflxdec.c in GStreamer before 1.10.2 allows remote attackers to cause a denial of service…
CVE-2016-10198 — CVSS 5.5 (medium): The gst_aac_parse_sink_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote…
CVE-2017-5842 — CVSS 5.5 (medium): The html_context_handle_element function in gst/subparse/samiparse.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers…
CVE-2017-5844 — CVSS 5.5 (medium): The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote…
CVE-2017-5846 — CVSS 5.5 (medium): The gst_asf_demux_process_ext_stream_props function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer before 1.10.3 allows…
CVE-2016-9813 — CVSS 5.5 (medium): The _parse_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (NULL pointer…
CVE-2017-5837 — CVSS 5.5 (medium): The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote…
CVE-2026-1940 — CVSS 5.1 (medium): An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation…
CVE-2016-9811 — CVSS 4.7 (medium): The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to always-malloc, allows remote…
CVE-2026-12892 — CVSS 4.4 (medium): A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or…
CVE-2026-12891 — CVSS 4.3 (medium): A flaw was found in the GStreamer gst-plugins-bad package. When processing a malformed H.266/VVC video stream with a crafted aspect ratio…