CVE-2025-2759CWE-732

GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability

High · published May 22, 2025

CVSS v3.0
7.0
EPSS
0%
Percentile
2.9
In the wild
Unconfirmed
What it is

GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of GStreamer. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the product installer. The issue results from incorrect permissions on folders. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25448.

The record
Technical detail
CVSS v3.0
7.0 · HIGH
Vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00138 · 2.9th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2025-05-22T00:57Z
EPSS history
Timeline
  • 22 MAY 00:57Z
    GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability
    cvelistv5