SB2026080646 - Multiple vulnerabilities in GStreamer

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080646

SB2026080646 - Multiple vulnerabilities in GStreamer

Published: August 6, 2026

Security Bulletin ID SB2026080646
CSH Severity
High
Patch available
YES
Number of vulnerabilities 18
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 28% Medium 44% Low 28%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 18 vulnerabilities.


1) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to integer overflow in the AVI demuxer superindex and subindex parsers when parsing a crafted AVI file. A remote attacker can supply a crafted AVI file to disclose sensitive information.

The bytes-per-entry value multiplied by the loop index can overflow and wrap to a small value, bypassing size comparison checks.


2) Memory leak (CVE-ID: N/A)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in the openjpegdec JPEG 2000 decoder element when handling error paths during stripe decoding. A remote attacker can provide a specially crafted JPEG 2000 file to cause a denial of service.

User interaction is required to process the crafted file.


3) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the openjpegdec JPEG 2000 decoder element when decoding a crafted JPEG 2000 codestream with a non-zero reference grid origin or attacker-controlled stripe coordinates. A remote attacker can provide a specially crafted JPEG 2000 file to execute arbitrary code.

The issue may also result in data corruption or a crash, and user interaction is required to process the crafted file.


4) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the QCELP RTP depayloader when processing crafted QCELP RTP packets that change the interleave parameter between packets within a single interleaving group. A remote attacker can send crafted QCELP RTP packets with inconsistent interleave values to execute arbitrary code.

The issue can also result in data corruption or a denial of service.


5) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the FFmpeg demuxer wrapper when parsing a crafted media file containing more than 20 streams. A remote attacker can provide a specially crafted media file to execute arbitrary code.

This may also result in data corruption or cause a denial of service.


6) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service or disclose sensitive information.

The vulnerability exists due to out-of-bounds write in the H.265/HEVC parser (gsth265parser) when parsing a crafted H.265/HEVC video stream containing a malformed sequence parameter set during short-term reference picture set parsing. A remote attacker can provide a specially crafted video stream to cause a denial of service or disclose sensitive information.


7) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the dvdsubdec element when processing crafted DVD subpicture streams. A remote attacker can supply a crafted DVD subpicture stream to cause a denial of service.

An application must explicitly include dvdsubdec in its pipeline for this vulnerability to be triggered.


8) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in the dvdsubdec element when processing crafted DVD subpicture streams. A remote attacker can supply a crafted DVD subpicture stream to execute arbitrary code.

An application must explicitly include dvdsubdec in its pipeline for this vulnerability to be triggered.


9) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the AVI demuxer subindex parser when parsing a crafted AVI file. A remote attacker can supply a crafted AVI file to cause a denial of service.

The missing validation on the entry count allows an arbitrarily large number of entries to be processed, resulting in excessive memory allocation.


10) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the adpcmdec element when parsing a crafted IMA ADPCM WAV file. A remote attacker can provide a specially crafted file to execute arbitrary code.

User interaction is required to open or preview the crafted file, though server-side transcoding can also trigger the issue during file processing.


11) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the AVI demuxer Nikon metadata tag parser when parsing a crafted AVI file. A remote attacker can supply a crafted AVI file to disclose sensitive information.

The issue occurs because a pointer is dereferenced without first checking that any data remains in the buffer.


12) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the AVI demuxer video properties ODML header parser when parsing a crafted AVI file. A remote attacker can supply a crafted AVI file to disclose sensitive information.

The issue results from using a user-controlled field count as a divisor instead of the actual field descriptor size when calculating how many entries fit in the buffer.


13) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the AVI demuxer stream details chunk parser for the FUJIFILM metadata path when parsing a crafted AVI file. A remote attacker can supply a crafted AVI file to cause a denial of service.

The issue occurs when date format normalization writes to read-only memory-mapped buffer data.


14) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to out-of-bounds write in the AVI demuxer stream details chunk parser for the FUJIFILM metadata path when parsing a crafted AVI file. A remote attacker can supply a crafted AVI file to execute arbitrary code.

Merely opening or previewing the file is sufficient to trigger the issue.


15) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the AVI demuxer stream details chunk parser for the FUJIFILM metadata path when parsing a crafted AVI file. A remote attacker can supply a crafted AVI file to disclose sensitive information.

Merely opening or previewing the file is sufficient to trigger the issue.


16) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in the FLAC stream header parser of the Matroska demuxer when parsing crafted FLAC codec private data from a Matroska or WebM file. A remote attacker can provide a specially crafted file to disclose sensitive information or cause a denial of service.

User interaction is required to open or preview a crafted file.


17) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to integer overflow and underflow in the ASF demuxer when parsing crafted ASF, WMV, or WMA files. A remote attacker can provide a specially crafted media file to disclose sensitive information and cause a denial of service.

Merely opening or previewing a crafted file is sufficient to trigger the vulnerability, and over-read data may be incorporated into media metadata tags, enabling limited heap information leakage.


18) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-18649)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in the rtph264depay and rtph265depay RTP depayload elements when processing fragmented NAL units during reassembly. A remote attacker can send a stream of syntactically valid FU-A fragments that never complete reassembly to cause a denial of service.

The issue does not require malformed packets or high packet rates.


Remediation

Install update from vendor's website.

References