Skip to main content

Gstreamer CVE-2026-3083

| EUVDEUVD-2026-12125 HIGH
Improper Validation of Array Index (CWE-129)
2026-03-13 zdi
RCE Buffer Overflow Gstreamer
8.8
CVSS 3.1 · Vendor: zdi
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send crafted RTP packet with X-QDM payload
  2. Exploit
    Parser reads malicious packetid element
  3. Execution
    Out-of-bounds write past array boundary
  4. Impact
    Arbitrary code execution in GStreamer process

Vulnerability Assessment

Weakness
CWE
CWE-129
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Array index validation
Exploitation Conditions

GStreamer library with rtpqdm2depay plugin enabled processing untrusted RTP streams containing X-QDM payload elements; user interaction required to initiate media playback or processing of malicious RTP packets.
Impact

This vulnerability presents high real-world risk based on multiple factors. The CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network-exploitable with low complexity, no privileges required, but user interaction needed. The score of 8.8 reflects severe impact across confidentiality, integrity, and availability. While EPSS data is not provided, the combination of remote exploitability, RCE capability, and GStreamer's widespread use in media applications makes this a priority. The requirement for user interaction (UI:R) slightly reduces automated exploitation risk but doesn't eliminate targeted attacks. No KEV listing suggests it's not yet actively exploited in the wild.
Exploit ScenarioDerived

An attacker crafts malicious X-QDM RTP packets with specially crafted packetid values that trigger the out-of-bounds write. These packets could be delivered via malicious media files, streaming servers, or WebRTC connections. When a vulnerable GStreamer application processes these packets, the attacker gains code execution in the application's context. While user interaction is required (opening a file, visiting a webpage with embedded media), the low attack complexity makes exploitation straightforward once a victim is targeted. No public proof-of-concept is currently referenced.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 13, 2026

Critical out-of-bounds write vulnerability in GStreamer's rtpqdm2depay component that allows remote code execution when processing malformed X-QDM RTP payloads. The vulnerability affects all versions of GStreamer (CPE shows wildcard versioning) and requires user interaction, though attack vectors vary by implementation. With a CVSS score of 8.8 and active patch available, this represents a significant risk for applications using GStreamer for media processing.

RemediationAI

Apply the official patch commit d60a94dee3c0a0942c9981491bf83e0de1900fbf from the GStreamer GitLab repository (https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d60a94dee3c0a0942c9981491bf83e0de1900fbf). Users should update to the latest patched version of GStreamer that includes this fix. As a temporary workaround, disable or block processing of X-QDM RTP streams if this functionality is not required. Monitor the Zero Day Initiative advisory ZDI-26-166 for additional updates.

Affected VersionsENISA

GStreamer 1c6e163aa33962f5ee4a87d29319ccdd5cb67612

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability occurs in GStreamer's RTP (Real-time Transport Protocol) depayloader for QDM2 audio codec streams, specifically in the rtpqdm2depay element. When parsing the packetid element from X-QDM RTP payloads, the code fails to properly validate array bounds, leading to CWE-129 (Improper Validation of Array Index). This allows writing data past the end of an allocated array, corrupting adjacent memory. GStreamer is a widely-used multimedia framework (CPE: cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*) employed in numerous applications for audio/video streaming and processing.

Know when Gstreamer gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (zdi) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of X-QDM RTP payload elements. When parsing the packetid element, the process does not properly validate user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28850.

Zero Day Initiative Advisories

ZDI-26-166 GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability Mar 2026

Executive ViewAI

Why It Matters

CVE-2026-3083 is a critical remote code execution vulnerability in GStreamer's media processing component that could allow attackers to gain unauthorized access to systems processing streaming media content. Organizations using GStreamer for video conferencing, media servers, or streaming applications face immediate risk of system compromise, and this vulnerability should be prioritized for rapid remediation given the high CVSS score of 8.8 and lack of available patches.

Business Impact: High
Compensating Controls

Implement network-level controls: restrict RTP traffic to known/trusted sources only; disable the rtpqdm2depay plugin if not actively required; deploy WAF/IPS rules to detect and block malformed QDM RTP payloads; segment media processing services to isolated network zones with restricted egress; run GStreamer services with minimal privileges and in sandboxed containers; monitor for suspicious process execution following media processing activities. Monitor vendor advisories daily for patch availability.

Threat Intelligence Overview

EPSS Score
0.4%
Top 42% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Related Vulnerabilities in GStreamer Media Parsing Buffer Overflow and Integer Overflow

View all 10
CVE-2026-3081 HIGH
7.8
CVE-2026-3082 HIGH
7.8
CVE-2026-2920 HIGH
7.8
CVE-2026-2921 HIGH
7.8
CVE-2026-2922 HIGH
7.8
CVE-2026-2923 HIGH
7.8
CVE-2026-3084 HIGH
7.8
CVE-2026-3085 HIGH
8.8
CVE-2026-3086 HIGH
7.8

More in Gstreamer

View all
CVE-2016-9636 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9635 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9634 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9808 HIGH POC
7.5 Jan 13

The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
CVE-2019-9928 HIGH
8.8 Apr 24

A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to

CVE-2025-47219 HIGH POC
8.1 Aug 07

A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
CVE-2022-1920 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
CVE-2022-2122 HIGH POC
7.8 Jul 19

A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
CVE-2022-1924 HIGH POC
7.8 Jul 19

A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
CVE-2022-1922 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
CVE-2022-1921 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
CVE-2022-1925 HIGH POC
7.8 Jul 19

A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska

Same weakness CWE-129 – Improper Validation of Array Index

View all
CVE-2022-35737 HIGH POC
7.5
CVE-2016-9053 CRITICAL POC
9.8
CVE-2020-27485 CRITICAL POC
9.9
CVE-2020-27483 CRITICAL POC
9.9
CVE-2024-24563 CRITICAL POC
9.8
CVE-2017-8797 HIGH
7.5
CVE-2018-11489 HIGH POC
8.8
CVE-2026-16651 HIGH POC
8.7

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:6259 ADVISORY https://access.redhat.com/errata/RHSA-2026:6300 ADVISORY https://access.redhat.com/errata/RHSA-2026:6750 ADVISORY https://access.redhat.com/errata/RHSA-2026:7673 ADVISORY https://access.redhat.com/errata/RHSA-2026:7850 ADVISORY https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d60a94dee3c0a0942c9981491bf83e0de1900fbf ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-3083 ADVISORY https://vuldb.com/?id.349625 REF https://access.redhat.com/errata/RHSA-2026:19024 REF https://access.redhat.com/errata/RHSA-2026:19180 REF https://access.redhat.com/errata/RHSA-2026:8854 REF https://access.redhat.com/errata/RHSA-2026:8857 REF https://access.redhat.com/errata/RHSA-2026:8862 REF https://access.redhat.com/errata/RHSA-2026:8874 REF https://access.redhat.com/errata/RHSA-2026:8876 REF https://access.redhat.com/errata/RHSA-2026:9446 REF https://access.redhat.com/errata/RHSA-2026:9447 REF https://access.redhat.com/errata/RHSA-2026:9487 REF https://access.redhat.com/errata/RHSA-2026:9488 REF https://access.redhat.com/security/cve/CVE-2026-3083 REF https://bugzilla.redhat.com/show_bug.cgi?id=2447498 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3083.json REF https://www.zerodayinitiative.com/advisories/ZDI-26-166/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy