In GStreamer through 1.26.1, the subparse plugin's parse_subrip_time function may write data past the bounds of a stack buffer, leading to a crash.

Fix status by distribution

Fixed packages published by each distribution for this CVE

• Alpine Linux ALPINE-CVE-2025-47806 gst-plugins-base Fixed in: 1.26.2-r0
• Debian DEBIAN-CVE-2025-47806 gst-plugins-base1.0 Fixed in: 1.18.4-2+deb11u4

References

• advisory github.com
• advisory github.com
• advisory nvd.nist.gov
• web gstreamer.freedesktop.org