CVE-2025-47219

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Aug 7, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-47229.8A vulnerability classified as critical has been found in itsourcecode Placement Management System 1.0. Affected is an unknown function of th CVE-2025-472205.3A local file enumeration was found in Keyfactor SignServer versions prior to 7.3.2 .The property VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH, which CVE-2025-472215.3An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. The properties ARCHIVETODISK_FILENAME-PATTERN, ARCHIVETOD CVE-2025-472226.5A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. Setting any chosen class name to any of the properties r CVE-2025-472263.3Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.CVE-2025-472277.5In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandle CVE-2025-472286.7In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows a CVE-2025-472295.5libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a denial of service (var_set_leave_quiet assertion failure and applicatio CVE-2025-47239.8A vulnerability classified as critical was found in itsourcecode Placement Management System 1.0. Affected by this vulnerability is an unkno CVE-2025-47249.8A vulnerability, which was classified as critical, has been found in itsourcecode Placement Management System 1.0. Affected by this issue is CVE-2025-472414.0In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority CVE-2025-472447.3Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by c