Skip to main content

Gstreamer CVE-2026-2920

| EUVDEUVD-2026-12113 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-03-13 zdi
RCE Buffer Overflow Heap Overflow Gstreamer
7.8
CVSS 3.1 · Vendor: zdi
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious ASF file with oversized stream header
  2. Exploit
    User opens file with GStreamer application
  3. Execution
    Heap buffer overflow triggered during header parsing
  4. Impact
    Arbitrary code execution with user privileges

Vulnerability Assessment

Weakness
CWE
CWE-122
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

GStreamer library processing ASF (Advanced Systems Format) files with ASF Demuxer enabled. User interaction required: victim must open attacker-supplied malicious ASF file in a GStreamer-based application (local attack vector).
Impact

Despite the high CVSS score of 7.8, the real-world risk is moderate. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates local access with required user interaction, limiting remote exploitation scenarios. No EPSS score is provided, suggesting low exploitation probability. The vulnerability is not listed in CISA's KEV catalog, indicating no known active exploitation. While the technical impact is severe (arbitrary code execution), the attack requires delivering a malicious media file and convincing a user to open it. This is a priority for systems processing untrusted media but not an emergency patch for most environments.
Exploit ScenarioDerived

An attacker crafts a malicious ASF media file with specially formatted stream headers designed to trigger the buffer overflow. The file is distributed via email, web download, or file sharing. When a victim opens the file in any GStreamer-based media player (like Totem, Rhythmbox, or custom applications), the overflow occurs during parsing, potentially allowing the attacker to execute code with the privileges of the media player process. No public proof-of-concept is available, but the technical details suggest exploitation is feasible with moderate effort.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 13, 2026

Heap-based buffer overflow vulnerability in GStreamer's ASF Demuxer component that allows remote attackers to execute arbitrary code when processing malicious ASF media files. The vulnerability requires user interaction (opening/processing a malicious file) and affects all versions of GStreamer based on the CPE data. No evidence of active exploitation (not in KEV) or public proof-of-concept exists, though Zero Day Initiative tracked it as ZDI-CAN-28843.

RemediationAI

Apply the patch available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/37d7991168a223d0810fd1f4493ec6a8b6a510d3. Update to the latest version of GStreamer that includes this fix. As a workaround, avoid processing ASF files from untrusted sources, implement sandboxing for media processing applications, and consider disabling ASF format support if not required. Monitor distribution-specific security updates as they will likely backport this fix.

Affected VersionsENISA

GStreamer 1c6e163aa33962f5ee4a87d29319ccdd5cb67612

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GStreamer is an open-source multimedia framework (CPE: cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*) widely used in Linux applications for media playback. The vulnerability occurs in the ASF (Advanced Systems Format) demuxer when parsing stream headers from ASF files - a format commonly used for Windows Media files. The root cause is CWE-122 (Heap-based Buffer Overflow), where the demuxer fails to validate the length of user-supplied data before copying it to a fixed-size heap buffer, allowing an attacker to overflow the buffer and potentially overwrite adjacent memory structures.

Know when Gstreamer gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (zdi) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 7.8 HIGH

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of stream headers within ASF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28843.

Zero Day Initiative Advisories

ZDI-26-164 GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability Mar 2026

Executive ViewAI

Why It Matters

CVE-2026-2920 is a high-severity buffer overflow in GStreamer's ASF Demuxer that could allow attackers to execute arbitrary code through malicious media files. This poses a moderate risk to organizations where users process untrusted ASF media files (audio/video content), though no active exploitation has been observed. Immediate action is required to inventory affected systems and implement mitigations, as no patch is currently available.

Business Impact: Medium
Compensating Controls

Disable GStreamer's ASF demuxer plugin if not required for business operations. Implement strict input validation and file type verification at application entry points (reject .asf, .wma, .wmv files from untrusted sources). Restrict media file processing to isolated systems or sandboxed environments. Apply network segmentation to limit exposure of media processing systems. Deploy endpoint detection and response (EDR) to monitor for suspicious process behavior. Educate users to avoid opening media files from untrusted sources.

Threat Intelligence Overview

EPSS Score
0.1%
Top 82% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Related Vulnerabilities in GStreamer Media Parsing Buffer Overflow and Integer Overflow

View all 10
CVE-2026-3081 HIGH
7.8
CVE-2026-3082 HIGH
7.8
CVE-2026-2921 HIGH
7.8
CVE-2026-2922 HIGH
7.8
CVE-2026-2923 HIGH
7.8
CVE-2026-3083 HIGH
8.8
CVE-2026-3084 HIGH
7.8
CVE-2026-3085 HIGH
8.8
CVE-2026-3086 HIGH
7.8

More in Gstreamer

View all
CVE-2016-9636 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9635 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9634 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9808 HIGH POC
7.5 Jan 13

The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
CVE-2019-9928 HIGH
8.8 Apr 24

A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to

CVE-2025-47219 HIGH POC
8.1 Aug 07

A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
CVE-2022-1920 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
CVE-2022-2122 HIGH POC
7.8 Jul 19

A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
CVE-2022-1924 HIGH POC
7.8 Jul 19

A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
CVE-2022-1922 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
CVE-2022-1921 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
CVE-2022-1925 HIGH POC
7.8 Jul 19

A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.70 Container suse/sl-micro/6.0/base-os-container:2.1.3-7.38 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.62 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.72 Image SL-Micro Affected
Container suse/sl-micro/6.0/toolbox:13.2-9.23 Affected
Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:6259 ADVISORY https://access.redhat.com/errata/RHSA-2026:6300 ADVISORY https://access.redhat.com/errata/RHSA-2026:6750 ADVISORY https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/37d7991168a223d0810fd1f4493ec6a8b6a510d3 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-2920 ADVISORY https://ubuntu.com/security/notices/USN-8896-1 ADVISORY https://vuldb.com/?id.349619 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0998/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20915/ REF https://access.redhat.com/errata/RHSA-2026:19024 REF https://access.redhat.com/errata/RHSA-2026:19180 REF https://access.redhat.com/errata/RHSA-2026:8854 REF https://access.redhat.com/errata/RHSA-2026:8862 REF https://access.redhat.com/security/cve/CVE-2026-2920 REF https://bugzilla.redhat.com/show_bug.cgi?id=2447490 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2920.json REF https://www.zerodayinitiative.com/advisories/ZDI-26-164/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy