Analyst readout for executives and security teams
Plain-English summary
CVE-2025-47219 is a GStreamer MP4 parsing flaw. Systems that process MP4 media with the isomp4 plugin may read beyond a memory buffer, potentially exposing sensitive data. The CVE is high severity, but the provided sources do not show known active exploitation.
Executive priority
Prioritize systems that automatically process external media, especially internet-facing or customer-facing workflows. Treat this as a high-priority patch-management item, not confirmed emergency exploitation, because public sources provided do not show active attacks.
Technical view
GStreamer through 1.26.1 has a CWE-125 heap out-of-bounds read in the isomp4 plugin, specifically qtdemux_parse_trak while parsing MP4 track data. The CVSS 3.1 score is 8.1 with network attack vector, high complexity, no privileges, and no user interaction.
Likely exposure
Exposure is most likely in applications, services, appliances, or embedded products using GStreamer to parse MP4 files or streams. Media ingestion, preview, transcoding, surveillance, and industrial products should be checked. Siemens published a product advisory, so affected Siemens environments should consult it directly.
Exploitation context
A malicious or malformed MP4 could trigger the vulnerable parsing path when processed by GStreamer. The source bundle marks KEV as false, and no cited source states active exploitation. The CVSS vector indicates no privileges or user interaction, but high attack complexity.
Researcher notes
The public description is limited: heap over-read in qtdemux_parse_trak during MP4 parsing, with possible information disclosure. The CVSS vector also rates integrity and availability high, but the supplied description emphasizes information disclosure. Validate against upstream and product advisories before scoping impact.
Mitigation direction
- Identify products and applications using GStreamer isomp4/qtdemux.
- Check vendor guidance for the fixed GStreamer release or product update.
- Restrict untrusted MP4 processing until updates are applied.
- Apply Siemens product-specific guidance where relevant.
Validation and detection
- Inventory GStreamer versions and flag deployments through 1.26.1.
- Confirm whether the isomp4 plugin is installed or enabled.
- Review services that automatically ingest MP4 files or streams.
- Check vendor advisories for affected product mappings and fixes.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-47219 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://gstreamer.freedesktop.org/security/CVE reference, mitre
- https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.mdCVE reference, mitre
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.