CVE-2025-47219

highpriority · track · 0EPSS 0.007 · 51 %ileDEEUNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.67% (51st) EPSS

CVSS 8.1 · high

Is it mine?

80 products

Check your exposure

Who says so?

8 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-22

In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedSIMATIC CN 4100siemens_psirt
Update to V5.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814144/
FixedSIMATIC CN 4100cisa_csaf_ot
Update to V5.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814144/

cvss

Technical severity, 0–10. One row per scoring source.

8.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 3.3–8.1

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.13.3lowAV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 2.2 · impact 5.9

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Siemens ProductCERT DE

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-125USCWE-125USCWE-125USCWE-125USCWE-125US

affected products (80)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
IBM App Connect Enterpriseall versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Dell Dell Secure Connect Gateway <5.36.00.16< 5.36.00.16cert_bundDE
Dell Secure Connect Gateway< 5.36.00.16cert_bundDE
Open Source GStreamer≤ gst-plugins-base <1.26.2cert_bundDE
Open Source Open Source GStreamer gst-plugins-base <1.26.2≤ gst-plugins-base <1.26.2cert_bundDE
SIMATIC CN 4100all versionscisa_csaf_otUS
Siemens SIMATIC CN 4100≤ vers:intdot/<5.0cisa_csaf_otUS
n/a n/a≤ n/aenisa_euvdEU
Axiom JDK Axiom AxiomJDK≤ 17.0.15fstec_bduRU
Axiom JDK Axiom AxiomJDK≤ 8u452fstec_bduRU
Axiom JDK Axiom AxiomJDK≤ 11.0.27fstec_bduRU
Axiom JDK Axiom AxiomJDK≤ 21.0.7fstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 2.15fstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 3.1fstec_bduRU
ООО «Открытая мобильная платформа» ОС Аврора≤ 5.2.1fstec_bduRU

showing 20 of 80

advisories (9)

Vendor and ecosystem advisories describing this.

NCSC-2026-0030Kwetsbaarheden verholpen in Oracle JavaNL2026-01-21csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in Oracle Java SE.
NCSC-2026-0147Kwetsbaarheden verholpen in Siemens-productenNL2026-05-13csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in verschillende (OT-)producten. Het gaat onder andere om producten in de Siemens RUGGEDCOM-, SCALANCE-, SIMATIC-, SIMIT-, SINAMICS-, SIPROTEC-, SENTRON- en Solid Edge-productreeksen.
SSA-032379SSA-032379: Multiple Vulnerabilities in SIMATIC CN 4100 Before V5.02026-05-12csaf · siemens_psirtDE
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
WID-SEC-W-2025-1171GStreamer: Mehrere SchwachstellenDeutsch2025-05-29csaf · cert_bundDE
Ein Angreifer kann eine Schwachstelle in GStreamer ausnutzen, um einen Denial of Service Angriff durchzuführen oder Informationen offenzulegen
WID-SEC-W-2026-0164Oracle Java SE: Mehrere SchwachstellenDeutsch2026-01-20csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Java SE ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
ICSA-26-134-10Siemens SIMATIC2026-05-12icsa · cisa_csaf_otUS
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
BIT-java-2025-472192026-05-06vendor · osvUS
In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.
BIT-java-min-2025-472192026-05-06vendor · osvUS
In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.
BIT-jre-2025-472192026-05-08vendor · osvUS
In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund cisa_csaf_ot ncsc_nl siemens_psirt NVD CVE.org MITRE

published 2025-08-07modified 2026-09-22

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan