CVE-2025-2759

Public on 2025-05-22
Modified on 2025-05-23
Description
GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of GStreamer. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the product installer. The issue results from incorrect permissions on folders. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25448.
Severity
Important severity
Important
CVSS v3 Base Score
7.0
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
HAQM Linux 2 - Core gstreamer Not Affected
HAQM Linux 2 - Core gstreamer1 Not Affected
HAQM Linux 2023 gstreamer1 Not Affected

CVSS Scores

Score Type Score Vector
HAQM Linux CVSSv3 7.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD CVSSv3 7.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H