Skip to main content

Gstreamer CVE-2026-3081

| EUVDEUVD-2026-12121 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-03-13 zdi
Buffer Overflow RCE Stack Overflow Gstreamer
7.8
CVSS 3.1 · Vendor: zdi
Share

Severity by source

Vendor (zdi) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
7.8 HIGH
qualitative

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
EUVD ID Assigned
Mar 13, 2026 - 21:01 euvd
EUVD-2026-12121
Analysis Generated
Mar 13, 2026 - 21:01 vuln.today
CVE Published
Mar 13, 2026 - 20:39 nvd
HIGH 7.8

DescriptionCVE.org

GStreamer H.266 Codec Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of decoding units. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28839.

AnalysisAI

Stack-based buffer overflow in GStreamer's H.266 codec parser that allows remote code execution when processing malicious video files. The vulnerability affects all versions of GStreamer (CPE shows wildcard versioning) and requires user interaction to trigger, such as opening a malicious media file. No active exploitation (not in KEV) or public PoC has been reported, with EPSS data unavailable.

Technical ContextAI

GStreamer is a widely-used open-source multimedia framework that processes audio/video streams. The vulnerability occurs in the H.266 (VVC - Versatile Video Coding) codec parser component when parsing decoding units. As a CWE-121 stack-based buffer overflow, the flaw stems from insufficient bounds checking when copying user-supplied data to a fixed-size stack buffer. The affected product identifier cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:* indicates all GStreamer versions are potentially vulnerable until patched.

RemediationAI

Apply the patch available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/2ffdfca2df95a7f605c922d3111e5d5be5314dca which fixes the buffer overflow issue. As a temporary mitigation, disable H.266/VVC codec support if not required, or implement strict input validation for media files from untrusted sources. Monitor the Zero Day Initiative advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-162/ for updates. Organizations should prioritize patching systems that process untrusted media content.

More in Gstreamer

View all
CVE-2016-9636 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9635 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9634 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9808 HIGH POC
7.5 Jan 13

The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
CVE-2019-9928 HIGH
8.8 Apr 24

A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to

CVE-2022-1920 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
CVE-2022-2122 HIGH POC
7.8 Jul 19

A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
CVE-2022-1924 HIGH POC
7.8 Jul 19

A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
CVE-2022-1922 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
CVE-2022-1921 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
CVE-2022-1925 HIGH POC
7.8 Jul 19

A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
CVE-2022-1923 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's matroska demuxer can cause denial of service through segmentation fault

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.0
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed

Share

CVE-2026-3081 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy