CVE catalog

CVE-2025-2759

gstreamer1.0: CVE-2025-2759

Severity: Low
Published: May 21, 2025, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.14% · Oct 25, 2026

GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of GStreamer. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. The issue results from incorrect permissions on folders. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25448.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	gstreamer1.0	sid	`1.28.8-1`	not affected
Debian	gstreamer1.0	forky	`1.28.8-1`	not affected
Debian	gstreamer1.0	trixie	`1.26.2-2`	not affected
Debian	gstreamer1.0	bookworm	`1.22.0-2+deb12u1`	not affected
Debian	gstreamer1.0	bookworm-security	`1.22.0-2+deb12u1`	not affected

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	gstreamer1.0	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	gstreamer1.0	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	gstreamer1.0	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	gstreamer1.0	source	bookworm	`Not affected`	unimportant	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[gir1.2-gstreamer-1.0]Not affected
Source package: [gstreamer1.0]
Details (4)
- 1.22.0-2+deb12u1 · amd64 · bookworm
  Not affected
  dsa · gstreamer1.0 · debian · bookworm
- 1.22.0-2+deb12u1 · arm64 · bookworm
  Not affected
  dsa · gstreamer1.0 · debian · bookworm
- 1.22.0-2+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · gstreamer1.0 · debian · bookworm
- 1.22.0-2+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · gstreamer1.0 · debian · bookworm
[gstreamer1.0-tools]Not affected
Source package: [gstreamer1.0]
Details (4)
- 1.22.0-2+deb12u1 · amd64 · bookworm
  Not affected
  dsa · gstreamer1.0 · debian · bookworm
- 1.22.0-2+deb12u1 · arm64 · bookworm
  Not affected
  dsa · gstreamer1.0 · debian · bookworm
- 1.22.0-2+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · gstreamer1.0 · debian · bookworm
- 1.22.0-2+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · gstreamer1.0 · debian · bookworm
[libgstreamer1.0-0]Not affected
Source package: [gstreamer1.0]
Details (4)
- 1.22.0-2+deb12u1 · amd64 · bookworm
  Not affected
  dsa · gstreamer1.0 · debian · bookworm
- 1.22.0-2+deb12u1 · arm64 · bookworm
  Not affected
  dsa · gstreamer1.0 · debian · bookworm
- 1.22.0-2+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · gstreamer1.0 · debian · bookworm
- 1.22.0-2+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · gstreamer1.0 · debian · bookworm
[libgstreamer1.0-dev]Not affected
Source package: [gstreamer1.0]
Details (4)
- 1.22.0-2+deb12u1 · amd64 · bookworm
  Not affected
  dsa · gstreamer1.0 · debian · bookworm
- 1.22.0-2+deb12u1 · arm64 · bookworm
  Not affected
  dsa · gstreamer1.0 · debian · bookworm
- 1.22.0-2+deb12u1 · amd64 · bookworm-security
  Not affected
  dsa · gstreamer1.0 · debian · bookworm
- 1.22.0-2+deb12u1 · arm64 · bookworm-security
  Not affected
  dsa · gstreamer1.0 · debian · bookworm

Observed: Oct 24, 2026, 10:06:01 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS]