SB2026080646 - Multiple vulnerabilities in GStreamer

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080646

SB2026080646 - Multiple vulnerabilities in GStreamer

Published: August 6, 2026 Updated: September 8, 2026

Security Bulletin ID SB2026080646
CSH Severity
High
Patch available
YES
Number of vulnerabilities 19
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 26% Medium 47% Low 26%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 19 vulnerabilities.


1) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to integer overflow in the AVI demuxer superindex and subindex parsers when parsing a crafted AVI file. A remote attacker can supply a crafted AVI file to disclose sensitive information.

The bytes-per-entry value multiplied by the loop index can overflow and wrap to a small value, bypassing size comparison checks.


2) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the RTP session management component when processing incoming RTP packets. A remote attacker can send valid RTP packets containing new source identifiers to exhaust available memory.

The RTP protocol permits up to 15 contributing source identifiers per packet.


3) Memory leak (CVE-ID: N/A)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in the openjpegdec JPEG 2000 decoder element when handling error paths during stripe decoding. A remote attacker can provide a specially crafted JPEG 2000 file to cause a denial of service.

User interaction is required to process the crafted file.


4) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the openjpegdec JPEG 2000 decoder element when decoding a crafted JPEG 2000 codestream with a non-zero reference grid origin or attacker-controlled stripe coordinates. A remote attacker can provide a specially crafted JPEG 2000 file to execute arbitrary code.

The issue may also result in data corruption or a crash, and user interaction is required to process the crafted file.


5) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the QCELP RTP depayloader when processing crafted QCELP RTP packets that change the interleave parameter between packets within a single interleaving group. A remote attacker can send crafted QCELP RTP packets with inconsistent interleave values to execute arbitrary code.

The issue can also result in data corruption or a denial of service.


6) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the FFmpeg demuxer wrapper when parsing a crafted media file containing more than 20 streams. A remote attacker can provide a specially crafted media file to execute arbitrary code.

This may also result in data corruption or cause a denial of service.


7) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service or disclose sensitive information.

The vulnerability exists due to out-of-bounds write in the H.265/HEVC parser (gsth265parser) when parsing a crafted H.265/HEVC video stream containing a malformed sequence parameter set during short-term reference picture set parsing. A remote attacker can provide a specially crafted video stream to cause a denial of service or disclose sensitive information.


8) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the dvdsubdec element when processing crafted DVD subpicture streams. A remote attacker can supply a crafted DVD subpicture stream to cause a denial of service.

An application must explicitly include dvdsubdec in its pipeline for this vulnerability to be triggered.


9) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in the dvdsubdec element when processing crafted DVD subpicture streams. A remote attacker can supply a crafted DVD subpicture stream to execute arbitrary code.

An application must explicitly include dvdsubdec in its pipeline for this vulnerability to be triggered.


10) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the AVI demuxer subindex parser when parsing a crafted AVI file. A remote attacker can supply a crafted AVI file to cause a denial of service.

The missing validation on the entry count allows an arbitrarily large number of entries to be processed, resulting in excessive memory allocation.


11) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the adpcmdec element when parsing a crafted IMA ADPCM WAV file. A remote attacker can provide a specially crafted file to execute arbitrary code.

User interaction is required to open or preview the crafted file, though server-side transcoding can also trigger the issue during file processing.


12) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the AVI demuxer Nikon metadata tag parser when parsing a crafted AVI file. A remote attacker can supply a crafted AVI file to disclose sensitive information.

The issue occurs because a pointer is dereferenced without first checking that any data remains in the buffer.


13) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the AVI demuxer video properties ODML header parser when parsing a crafted AVI file. A remote attacker can supply a crafted AVI file to disclose sensitive information.

The issue results from using a user-controlled field count as a divisor instead of the actual field descriptor size when calculating how many entries fit in the buffer.


14) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the AVI demuxer stream details chunk parser for the FUJIFILM metadata path when parsing a crafted AVI file. A remote attacker can supply a crafted AVI file to cause a denial of service.

The issue occurs when date format normalization writes to read-only memory-mapped buffer data.


15) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to out-of-bounds write in the AVI demuxer stream details chunk parser for the FUJIFILM metadata path when parsing a crafted AVI file. A remote attacker can supply a crafted AVI file to execute arbitrary code.

Merely opening or previewing the file is sufficient to trigger the issue.


16) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the AVI demuxer stream details chunk parser for the FUJIFILM metadata path when parsing a crafted AVI file. A remote attacker can supply a crafted AVI file to disclose sensitive information.

Merely opening or previewing the file is sufficient to trigger the issue.


17) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in the FLAC stream header parser of the Matroska demuxer when parsing crafted FLAC codec private data from a Matroska or WebM file. A remote attacker can provide a specially crafted file to disclose sensitive information or cause a denial of service.

User interaction is required to open or preview a crafted file.


18) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to integer overflow and underflow in the ASF demuxer when parsing crafted ASF, WMV, or WMA files. A remote attacker can provide a specially crafted media file to disclose sensitive information and cause a denial of service.

Merely opening or previewing a crafted file is sufficient to trigger the vulnerability, and over-read data may be incorporated into media metadata tags, enabling limited heap information leakage.


19) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-18649)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in the rtph264depay and rtph265depay RTP depayload elements when processing fragmented NAL units during reassembly. A remote attacker can send a stream of syntactically valid FU-A fragments that never complete reassembly to cause a denial of service.

The issue does not require malformed packets or high packet rates.


Remediation

Install update from vendor's website.

References