Gstreamer
CVE-2021-3498
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Despite the high CVSS score of 7.8, the real-world risk is moderate based on multiple factors. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates local attack requiring user interaction to open a malicious file, limiting remote exploitation potential. The EPSS score of 0.24% (47th percentile) suggests below-average exploitation activity compared to other CVEs. While a public proof-of-concept exists according to PacketStorm Security, the vulnerability is not listed in CISA KEV indicating no confirmed exploitation in the wild. The technical impact remains severe (full system compromise possible) but the exploitation requirements make this a medium-priority issue for most organizations unless they process untrusted media files. |
| Exploit ScenarioDerived | An attacker creates a specially crafted Matroska video file containing malformed metadata that triggers the heap overflow when parsed. When a user opens this file in a media player or application using vulnerable GStreamer libraries, the overflow corrupts heap memory allowing arbitrary code execution. A working proof-of-concept exploit demonstrating use-after-free conditions is publicly available at http://packetstormsecurity.com/files/162952/Gstreamer-Matroska-Demuxing-Use-After-Free.html, making exploitation straightforward for attackers with local access or ability to deliver malicious files. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A heap corruption vulnerability exists in GStreamer media framework versions before 1.18.4 when parsing malformed Matroska (MKV) video files. An attacker can craft a malicious Matroska file that, when processed by a vulnerable GStreamer installation, triggers heap memory corruption leading to potential code execution with the privileges of the application using GStreamer. While not known to be actively exploited in the wild (not in KEV), a public proof-of-concept exploit is available and the EPSS score of 0.24% indicates moderate exploitation likelihood.
RemediationAI
Upgrade GStreamer to version 1.18.4 or later which contains the security fix for this heap corruption vulnerability. Distribution-specific updates are available through Debian Security Advisory DSA-4900 at https://www.debian.org/security/2021/dsa-4900 and Gentoo Linux Security Advisory GLSA-202208-31 at https://security.gentoo.org/glsa/202208-31. For systems that cannot be immediately patched, implement strict input validation for Matroska files and avoid processing MKV files from untrusted sources. Consider sandboxing media processing applications using AppArmor or SELinux to limit potential damage from exploitation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a popular open-source multimedia framework used for creating streaming media applications across Linux distributions and embedded systems. The vulnerability affects the Matroska demuxer component responsible for parsing MKV container format files, as indicated by the specific affected CPE cpe:2.3:a:gstreamer:gstreamer. The root cause is a buffer overflow (CWE-119) where improper bounds checking during Matroska file parsing allows writing beyond allocated heap memory boundaries. Major Linux distributions including Debian 10, Red Hat Enterprise Linux 7 and 8 ship vulnerable versions of GStreamer in their repositories.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
GStreamer before 1.18.4 might cause heap corruption when parsing certain malformed Matroska files.
Executive ViewAI
CVE-2021-3498 presents notable security risk, a buffer overflow vulnerability rated CVSS 7.8. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. A patch is available and should be applied as part of regular vulnerability management.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
GitHub PoC
Exploit-DB