Heap-based buffer overflow in gstreamer - CVE-2026-2920

Vulnerability identifier: #VU123644

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-2920

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the processing of stream headers within ASF files. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

gstreamer
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Workstation Extension 15
Anolis OS
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
openSUSE Leap
Fedora
gstreamer1-plugins-good-gtk
gstreamer1-plugins-good
gstreamer1-plugins-good (Red Hat package)
gstreamer1-plugins-base (Red Hat package)
gstreamer1-plugins-bad-free (Red Hat package)
gst-plugins-ugly1.0 (Debian package)
gstreamer1-plugins-ugly-free (Red Hat package)
gstreamer1-plugins-bad-free-libs
gstreamer1-plugins-bad-free-devel
gstreamer1-plugins-bad-free
gstreamer1-plugins-base-devel
gstreamer1-plugins-base
gstreamer-plugins-ugly-debuginfo
gstreamer-plugins-ugly
gstreamer-plugins-ugly-debugsource
gstreamer-plugins-ugly-32bit
gstreamer-plugins-ugly-32bit-debuginfo
gstreamer-plugins-ugly-lang
gstreamer-plugins-ugly-64bit
gstreamer-plugins-ugly-64bit-debuginfo
mingw-gstreamer1-plugins-good
mingw-gstreamer1
mingw-gstreamer1-plugins-bad-free
mingw-gstreamer1-plugins-base
gstreamer1
gstreamer1-doc
gstreamer1-devel

Install updates from vendor's website.

gstreamer - update to 1.28.1
gstreamer1-plugins-good-gtk - update to 1.16.1-6
gstreamer1-plugins-good - update to 1.16.1-6
gstreamer1-plugins-good (Red Hat package) - addressed in versions 1.16.1-6.el8_10, 1.22.12-5.el9_7, 1.24.11-2.el10_1
gstreamer1-plugins-base (Red Hat package) - addressed in versions 1.16.1-6.el8_10, 1.22.12-5.el9_7, 1.24.11-2.el10_1
gstreamer1-plugins-bad-free (Red Hat package) - addressed in versions 1.16.1-6.el8_10, 1.22.12-5.el9_7, 1.24.11-3.el10_1
gst-plugins-ugly1.0 (Debian package) - addressed in versions 1.22.0-2+deb12u2, 1.26.3-4+deb13u1
gstreamer1-plugins-ugly-free (Red Hat package) - addressed in versions 1.22.12-4.el9_7, 1.24.11-2.el10_1
gstreamer1-plugins-bad-free-libs - update to 1.22.12-5.0.1
gstreamer1-plugins-bad-free-devel - update to 1.22.12-5.0.1
gstreamer1-plugins-bad-free - update to 1.22.12-5.0.1
gstreamer1-plugins-base-devel - update to 1.22.12-5.0.1
gstreamer1-plugins-base - update to 1.22.12-5.0.1
gstreamer-plugins-ugly-debuginfo - update to 1.24.0-150600.3.5.1
gstreamer-plugins-ugly - update to 1.24.0-150600.3.5.1
gstreamer-plugins-ugly-debugsource - update to 1.24.0-150600.3.5.1
gstreamer-plugins-ugly-32bit - update to 1.24.0-150600.3.5.1
gstreamer-plugins-ugly-32bit-debuginfo - update to 1.24.0-150600.3.5.1
gstreamer-plugins-ugly-lang - update to 1.24.0-150600.3.5.1
gstreamer-plugins-ugly-64bit - update to 1.24.0-150600.3.5.1
gstreamer-plugins-ugly-64bit-debuginfo - update to 1.24.0-150600.3.5.1
mingw-gstreamer1-plugins-good - addressed in versions 1.26.11-1.fc42, 1.26.11-1.fc43
mingw-gstreamer1 - addressed in versions 1.26.11-1.fc42, 1.26.11-1.fc43
mingw-gstreamer1-plugins-bad-free - addressed in versions 1.26.11-1.fc42, 1.26.11-1.fc43
mingw-gstreamer1-plugins-base - addressed in versions 1.26.11-1.fc42, 1.26.11-1.fc43
gstreamer1 - update to 1.28.1-1
gstreamer1-doc - update to 1.28.1-1
gstreamer1-devel - update to 1.28.1-1

• https://www.zerodayinitiative.com/advisories/ZDI-26-164/
• https://gstreamer.freedesktop.org/security/sa-2026-0006.html

• Multiple vulnerabilities in GStreamer
• SUSE update for gstreamer-plugins-ugly
• Fedora 42 update for mingw-gstreamer1, mingw-gstreamer1-plugins-bad-free, mingw-gstreamer1-plugins-base, mingw-gstreamer1-plugins-good
• Fedora 43 update for mingw-gstreamer1, mingw-gstreamer1-plugins-bad-free, mingw-gstreamer1-plugins-base, mingw-gstreamer1-plugins-good
• Anolis OS update for gstreamer1
• Red Hat Enterprise Linux 10 update for multiple packages
• Red Hat Enterprise Linux 9 update for multiple packages
• Debian update for gst-plugins-ugly1.0
• Anolis OS update for gstreamer1-plugins-base
• Anolis OS update for gstreamer1-plugins-bad-free
• Red Hat Enterprise Linux 8 update for multiple packages
• Anolis OS update for gstreamer1-plugins-good