GStreamer CVE-2026-18295

Exploitation requires that the target user opens or previews a crafted MRF media file - for example, by opening it in a GStreamer-backed media player, triggering GNOME Files or Nautilus thumbnail rendering, or loading a web page that causes browser-side GStreamer invocation for media handling. The CVSS UI:R metric confirms that user interaction is mandatory; the vulnerability cannot be triggered passively or remotely without the user actively initiating media parsing. The AV:L vector confirms this is a file-based attack delivered to the local process context, not exploitation of a network-listening service. No authentication or account privileges are required (PR:N) once the target opens the file. Exploitation is bounded to the privilege level of the victim user process - no privilege escalation to root is indicated by the CVSS S:U scoping. GStreamer must be installed with MRF format support present in the active plugin set.

The CVSS 3.0 score of 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H accurately reflects the severity ceiling: full RCE impact but constrained by local attack vector and mandatory user interaction. The AV:L designation is important - despite the description framing this as a remote attacker vulnerability, exploitation is file-based (delivered locally or via browser), not a direct network service attack. This meaningfully reduces opportunistic mass exploitation risk compared to an AV:N flaw. No EPSS score was supplied, leaving probabilistic exploitation likelihood unquantified. No CISA KEV listing is present, and no public proof-of-concept has been identified - exploitation would currently require independent exploit development from ZDI's advisory detail. The ZDI disclosure path (ZDI-CAN-29510 → ZDI-26-463) indicates this was found through coordinated vulnerability research, and GStreamer's own advisory sa-2026-0050 confirms vendor acknowledgment. Real-world risk is meaningful for desktop Linux users and any application integrating GStreamer for media handling, but the UI:R gate significantly limits automated or wormable exploitation.

An attacker crafts a malicious MRF media file embedding oversized or malformed field values designed to trigger the OOB write in GStreamer's parser, then distributes it via email attachment, a drive-by download page, or a shared document link. When the victim opens the file in a media player, GNOME file manager (triggering thumbnail generation), or a browser with GStreamer integration, the parser processes the malformed input, corrupts heap memory, and executes attacker-controlled shellcode in the context of the current user. No public proof-of-concept is known at time of analysis, but ZDI's advisory (ZDI-26-463) contains sufficient technical context for a skilled researcher to develop working exploit code.