Security Advisory 2025-0008 (CVE-2025-67328, CVE-2025-67329)
|
|
| Summary |
Multiple out-of-bounds reads in MIDI parser |
| Date |
2025-12-27 18:00 |
| Affected Versions |
GStreamer gst-plugins-bad < 1.24.13, >= 1.26.0, < 1.26.2 |
| IDs |
GStreamer-SA-2025-0008
CVE-2025-67328
CVE-2025-67329 |
Details
Multiple out-of-bounds reads in the MIDI parser that can cause crashes for
certain input files.
Impact
It is possible for a malicious third party to trigger an out-of-bounds read
that can result in a crash of the application.
Solution
The gst-plugins-bad 1.24.13 and 1.26.2 releases address the issue. People
using older versions of GStreamer should apply the patch and recompile.
References
The GStreamer project
CVE Database Entries
GStreamer releases
1.26 (current stable)
1.24 (previous stable)
Patches
