CVE-2025-47807: GStreamer Subparse Plugin DOS Vulnerability

CVE-2025-47807 Overview

CVE-2025-47807 is a NULL pointer dereference vulnerability in GStreamer's subparse plugin. The flaw resides in the subrip_unescape_formatting function, which processes SubRip subtitle files. A crafted subtitle file causes the function to dereference a NULL pointer, terminating the media pipeline. The vulnerability affects GStreamer versions through 1.26.1 and is tracked under [CWE-476]. Exploitation requires local file access and user interaction, such as opening a malicious subtitle file in a GStreamer-based media player. Successful exploitation results in application crashes and denial of service.

Critical Impact
A malicious .srt subtitle file can crash any application using GStreamer's subparse plugin, disrupting media playback and workflows that rely on automated subtitle processing.

Affected Products

GStreamer versions through 1.26.1
Applications embedding the GStreamer subparse plugin
Media players and transcoding tools built on GStreamer pipelines

Discovery Timeline

2025-08-07 - CVE-2025-47807 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47807

Vulnerability Analysis

The subparse plugin in GStreamer parses subtitle formats including SubRip (.srt). Its subrip_unescape_formatting function processes formatting tags embedded in subtitle text. When the function encounters specific malformed input, it fails to validate a pointer before dereferencing it. The resulting NULL pointer dereference terminates the process handling the subtitle stream.

Because GStreamer is widely embedded in Linux desktop environments, media players, and server-side transcoding pipelines, any tool loading a subtitle file through subparse can crash. The impact is limited to availability, with no confidentiality or integrity consequences reported.

Root Cause

The root cause is missing input validation inside subrip_unescape_formatting. The function assumes prior parsing stages produced non-NULL pointers before performing string operations. A crafted subtitle file breaks that assumption, and the unchecked dereference triggers an immediate segmentation fault.

Attack Vector

An attacker delivers a malicious subtitle file to the victim. The victim opens the file in a GStreamer-backed media player, or a server-side pipeline ingests the file for transcoding or preview generation. Delivery vectors include email attachments, downloads bundled with video content, and shared network storage. The attack requires local access and user interaction, and it does not grant code execution or data disclosure. See the ATREDIS-2025-0003 advisory for technical detail on the malformed input pattern.

Detection Methods for CVE-2025-47807

Indicators of Compromise

Repeated crashes of media player processes such as totem, rhythmbox, or GStreamer-based transcoders immediately after loading a subtitle file
SIGSEGV signals recorded in system logs or coredumps referencing libgstsubparse.so and the subrip_unescape_formatting symbol
Presence of unexpected .srt or .sub files in media directories that consistently cause pipeline termination

Detection Strategies

Inspect crash telemetry for segmentation faults originating in GStreamer subtitle parsing modules
Monitor GStreamer pipeline error events, specifically GST_MESSAGE_ERROR messages tied to the subparse element
Correlate subtitle file ingestion events with process termination in automated media processing workflows

Monitoring Recommendations

Enable coredump collection on Linux hosts to capture crash artifacts referencing GStreamer libraries
Alert on abnormal termination rates for media player and transcoder processes across endpoints and servers
Track versions of installed GStreamer packages via software inventory to identify hosts still running vulnerable builds

How to Mitigate CVE-2025-47807

Immediate Actions Required

Inventory all systems running GStreamer 1.26.1 or earlier, including desktop workstations and media processing servers
Apply distribution-provided GStreamer updates as soon as they are published
Restrict ingestion of untrusted subtitle files in automated pipelines until patches are validated

Patch Information

Monitor the GStreamer Security Page for the fixed release that addresses subrip_unescape_formatting. Linux distributions typically ship updates through their standard package repositories. Apply upstream patches on custom builds and rebuild any statically linked applications that embed the subparse plugin.

Workarounds

Disable the subparse plugin in environments that do not require subtitle support by removing or renaming libgstsubparse.so
Sandbox media player processes using tools such as bubblewrap or firejail to contain crashes and limit blast radius
Validate subtitle files with a hardened parser before passing them to GStreamer pipelines

bash

# Remove the vulnerable plugin from a GStreamer installation
sudo mv /usr/lib/x86_64-linux-gnu/gstreamer-1.0/libgstsubparse.so \
        /usr/lib/x86_64-linux-gnu/gstreamer-1.0/libgstsubparse.so.disabled

# Verify the plugin is no longer loaded
gst-inspect-1.0 subparse