SB2026080645 - Multiple vulnerabilities in GStreamer

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080645

SB2026080645 - Multiple vulnerabilities in GStreamer

Published: August 6, 2026 Updated: August 6, 2026

Security Bulletin ID SB2026080645
CSH Severity
High
Patch available
YES
Number of vulnerabilities 27
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 37% Medium 59% Low 4%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 27 vulnerabilities.


1) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in the H.266 video bitstream parser slice header processing when parsing a crafted H.266 video stream. A remote attacker can supply a specially crafted H.266 video stream to execute arbitrary code.

The issue occurs in the code that tracks CTU entry points during slice header parsing, where writes to a fixed-size entry point array are not properly bounded before each write.


2) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the ASF demuxer when parsing payload extension data from packet replicated data. A remote attacker can trigger an out-of-bounds read error and read contents of memory on the system.


3) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the ASF-over-RTP depayloader element (rtpasfdepay) when processing crafted RTP packets with ASF payload data. A remote attacker can send crafted RTP packets to cause a denial of service.

Optional RTP header fields were read before bounds validation, and ASF packet header fields were parsed without checking that the offset remains within the allocated buffer.


4) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in the ASF-over-RTP depayloader element (rtpasfdepay) when processing crafted RTP packets with ASF payload data. A remote attacker can send crafted RTP packets to cause a denial of service.

The issue occurs when the reassembled ASF chunk size exceeds the negotiated maximum packet size, leading to an unsigned arithmetic underflow and a very large value being passed to memset.


5) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the RTP CELT depayloader when parsing RTP packet payloads. A remote attacker can send a specially crafted RTP packet to cause a denial of service.

The issue leads to a NULL pointer dereference after a failed sub-buffer extraction.


6) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the mpeg4videoparse element when parsing a crafted MPEG-4 Visual stream. A remote attacker can provide a specially crafted stream to cause a denial of service.


7) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the qtmoovrecover element when parsing recovery files. A local user can provide a crafted MRF file to execute arbitrary code.

User interaction is required to explicitly invoke the moov recovery tool with the crafted input file.


8) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the RTP SBC depayloader element (rtpsbcdepay) when processing a crafted RTP packet with a minimal payload in builds with assertions disabled. A remote attacker can send a specially crafted RTP packet to cause a denial of service.

This issue occurs only in builds with assertions disabled.


9) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the RTP SBC depayloader element (rtpsbcdepay) when processing crafted RTP packets with no payload data or a minimal payload. A remote attacker can send a specially crafted RTP packet to cause a denial of service.

In builds with assertions disabled, the issue can additionally trigger a use-after-free of a GstBuffer object, but the practical impact remains limited to a crash.


10) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in the gdkpixbufdec element when processing crafted image sequences with later frames larger than the first frame. A remote attacker can provide a specially crafted image sequence to execute arbitrary code.

The issue can also result in a crash, denial of service, or data corruption, and occurs because the output buffer pool is not re-evaluated when frame dimensions or pixel format change.


11) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in the Opus audio decoder when processing crafted Opus streams with more than 64 channels. A remote attacker can supply a specially crafted Opus stream to execute arbitrary code or cause a denial of service.

The issue is triggered because the decoder uses the channel count from the stream header for memory operations on fixed-size 64-element arrays.


12) Stack-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.

The vulnerability exists due to stack-based buffer overflow in the Opus audio decoder when processing crafted Opus streams with more than 64 channels. A remote attacker can supply a specially crafted Opus stream to execute arbitrary code or cause a denial of service.

The issue is triggered because the decoder uses the channel count from the stream header for memory operations on fixed-size 64-element arrays.


13) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to a heap-based buffer overflow in the encoding-target loader when parsing malformed UTF-8 input through the public encoding profile API. A local user can provide a specially crafted string containing a truncated UTF-8 sequence to cause a denial of service or disclose sensitive information.

The issue is triggered when the input ends with a truncated multi-byte UTF-8 sequence.


14) Out-of-bounds read (CVE-ID: CVE-2026-53701)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the H.266/VVC codec parser (gsth266parser) when parsing Picture Parameter Set (PPS) tile slices. A remote attacker can provide a crafted H.266/VVC video stream with a large picture dimension and an excessive number of explicitly signalled slices per tile to disclose sensitive information or cause a denial of service.


15) Integer overflow (CVE-ID: CVE-2026-52722)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service or disclose sensitive information.

The vulnerability exists due to integer overflow in vmncdec element when parsing crafted VMNC streams with cursor rectangle data. A remote attacker can send a specially crafted VMNC stream to cause a denial of service or disclose sensitive information.

The issue occurs during cursor payload size computation using signed integer arithmetic, which can produce a negative length value that bypasses a subsequent short-packet check.


16) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in the RTP JPEG depayloader when processing crafted RTP packets with custom quantization tables. A remote attacker can send a specially crafted RTP packet to disclose sensitive information or cause a denial of service.

The issue occurs when the precision field indicates larger 16-bit quantization tables than the actual quantization table data provided in the packet.


17) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service or disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the VP9 parser when parsing VP9 superframe metadata. A remote attacker can provide a crafted VP9 superframe with a short buffer and large index size fields to cause a denial of service or disclose sensitive information.

The issue is triggered because the computed superframe index size is not validated against the provided data buffer before index parsing.


18) Stack-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a stack-based buffer overflow in the ccconverter element when parsing a crafted media file containing oversized CEA608 closed caption data during conversion to CEA708 CDP format. A remote attacker can provide a specially crafted media file to execute arbitrary code.

The issue may also cause a crash or denial of service.


19) Improper Authentication (CVE-ID: CVE-2026-14935)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication.

The vulnerability exists due to improper authentication in webrtcbin SDP fingerprint validation when processing remote descriptions for active media sections. A remote attacker can strip fingerprint attributes from remote SDP signaling to bypass authentication.

This weakens the WebRTC check that binds the DTLS certificate to the signaled identity.


20) Stack-based buffer overflow (CVE-ID: CVE-2026-59692)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to stack-based buffer overflow in the DTLS connection implementation when verifying peer certificates during the DTLS handshake. A remote attacker can send a certificate with an oversized Subject DN to execute arbitrary code.

The issue can also cause a process crash or data corruption, and can be triggered by a DTLS-SRTP or WebRTC peer during handshake verification.


21) Heap-based buffer overflow (CVE-ID: CVE-2026-59691)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in rfbsrc element RFB decoder when decoding crafted framebuffer updates from a VNC server. A remote attacker can operate a crafted VNC server and send framebuffer updates with specific pixel formats and encoding types to execute arbitrary code.

This may also cause a crash, denial of service, or data corruption in the client application.


22) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the WAV parser (wavparse) when processing crafted WAV files in streaming (push) mode. A remote attacker can supply a crafted WAV file with an over-declared adtl chunk size to cause a denial of service.

Remote exploitation is possible when the application uses push mode with network source elements such as HTTP sources.


23) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to integer overflow in the vendored LZO1X decompressor used by the Matroska demuxer when parsing a crafted Matroska or WebM file with LZO1X-compressed data. A remote attacker can provide a specially crafted file to execute arbitrary code.

Merely opening or previewing the crafted file is sufficient to trigger the issue because the Matroska demuxer may be automatically plugged by affected pipelines.


24) Out-of-bounds read (CVE-ID: CVE-2026-12892)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the H.264 NAL unit parser when parsing crafted H.264 bitstreams. A remote attacker can provide a specially crafted H.264 stream containing undersized slice NAL units to disclose sensitive information or cause a denial of service.

The issue affects slice NAL types that use multi-byte extension headers for MVC and SVC profiles, and can be reached through media files, network streams, or web content.


25) Out-of-bounds read (CVE-ID: CVE-2026-12891)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the H.266/VVC parser when parsing VUI parameters from the sequence parameter set. A local user can provide a crafted H.266/VVC media file with an invalid aspect ratio index to cause a denial of service.

User interaction is required to open or process a crafted media file.


26) Out-of-bounds write (CVE-ID: CVE-2026-52720)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in the rfbsrc element when processing crafted RFB protocol data. A remote attacker can send crafted framebuffer update messages with rectangle coordinates extending beyond the framebuffer boundaries to execute arbitrary code.

The issue can also be triggered by connecting to a crafted VNC server.


27) Out-of-bounds read (CVE-ID: CVE-2026-52721)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in the pcapparse element when parsing a crafted PCAP file with malformed IPv4 or TCP header fields. A remote attacker can provide a specially crafted PCAP file to disclose sensitive information or cause a denial of service.

User interaction is required to open or process a crafted PCAP file.


Remediation

Install update from vendor's website.

References