ZDI-CAN-25448: ZDI-25-268: GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of GStreamer. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product installer. The issue results from incorrect permissions on folders. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of GStreamer. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.0. The following CVEs are assigned: CVE-2025-2759.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-25448?
The severity of ZDI-CAN-25448 is rated at 7.0 according to the CVSS rating system.
How do I fix ZDI-CAN-25448?
To fix ZDI-CAN-25448, you should update GStreamer to the latest version that addresses this vulnerability.
Who is affected by ZDI-CAN-25448?
ZDI-CAN-25448 affects installations of GStreamer where local attackers can escalate privileges.
What type of attack does ZDI-CAN-25448 involve?
ZDI-CAN-25448 involves a local privilege escalation attack that requires low-privileged code execution.
What software is impacted by ZDI-CAN-25448?
The impacted software by ZDI-CAN-25448 is GStreamer.