CVE-2025-47219: 
NixOS vulnerability analysis and mitigation

In GStreamer through 1.26.1, a vulnerability was discovered in the isomp4 plugin's qtdemuxparsetrak function that could lead to information disclosure. The vulnerability was identified and disclosed on August 7, 2025, affecting the GStreamer multimedia framework (NVD, GStreamer Security).

The vulnerability involves an out-of-bounds read vulnerability in the qtdemuxparsetrak function when parsing MP4 files. The issue occurs when processing heap buffer data, potentially exposing sensitive information. The vulnerability has been assigned a CVSS v3.1 score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a high-severity issue that requires no privileges or user interaction to exploit (NVD).

The vulnerability can lead to information disclosure through out-of-bounds read operations when processing MP4 files. This could potentially expose sensitive data stored in memory, compromising the security of the system processing the malicious media files (NVD).

The vulnerability has been addressed in versions after GStreamer 1.26.1. Users are advised to upgrade to the latest version of GStreamer to mitigate this security issue (GStreamer Security).