EUVD-2026-36801
GHSA-hghw-p2mw-fvch
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
File is delivered over the network and opened by a user (AV:N, UI:R); no auth needed (PR:N); reliably crashes the pipeline (A:H) with limited OOB leak into metadata (C:L), no integrity impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets within the chunk without first checking that the chunk contains enough data. If a malicious file provides an MDPR chunk that is too small to contain a complete audio stream header, the parser reads beyond the end of the buffer. This can cause the application to crash. In some cases, bytes read past the buffer boundary may be incorporated into stream metadata, which could result in limited information disclosure.
AnalysisAI
Out-of-bounds read in the GStreamer RealMedia demuxer (gst-plugins-ugly) allows a maliciously crafted .rm file to crash the consuming application and potentially leak small amounts of adjacent heap memory through stream metadata. The flaw affects Red Hat Enterprise Linux 7, 8, 9, and 10 systems shipping the vulnerable demuxer, and exploitation requires a user to open or otherwise process the file (UI:R). There is no public exploit identified at time of analysis, and the issue is not on the CISA KEV list.
Technical ContextAI
GStreamer's gst-plugins-ugly bundle contains the RealMedia (.rm) demuxer, which parses container-level chunks including MDPR (Media Properties) chunks describing each stream. For audio header versions 4 and 5, the demuxer reads codec type, packet size, sample rate, channel count, and extra codec data length from fixed byte offsets relative to the chunk start. The root cause is CWE-125 (Out-of-bounds Read): the code does not validate that the MDPR chunk is large enough to contain a complete audio stream header before indexing into it, so a short chunk causes the parser to dereference bytes past the buffer boundary. Because some of those out-of-bounds bytes are copied into the GStreamer stream's metadata structures, they can be surfaced back to applications that introspect stream tags or caps, creating a narrow information-disclosure channel in addition to the more reliable crash.
RemediationAI
No vendor-released patch identified at time of analysis from the supplied data - the Red Hat CVE page and Bugzilla entry are referenced but no fixed package version is included, so administrators should monitor https://access.redhat.com/security/cve/CVE-2026-53703 and https://bugzilla.redhat.com/show_bug.cgi?id=2487613 for an RHSA and apply the gst-plugins-ugly update via dnf/yum as soon as it ships. As compensating controls until a patch is available, uninstall gst-plugins-ugly on systems that do not need RealMedia playback (side effect: loss of .rm/.ra and other ugly-bundle codec support); block or strip .rm/.ra attachments at the mail gateway and proxy (side effect: legitimate but rare RealMedia content is rejected); and instruct users not to open .rm files from untrusted sources, particularly in file managers or browsers that auto-probe media via GStreamer thumbnailers (side effect: relies on user discipline). On servers, disabling GStreamer-based thumbnailing services (e.g. tracker-miner, tumbler) removes the most common path by which a crafted file could be processed without explicit user action.
More in Red Hat Enterprise Linux 10
View allRemote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Sandbox escape in PipeWire's PulseAudio compatibility layer lets a low-privileged process inside a confined environment
Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | Affected |
| openSUSE Leap 16.0 | Affected |
| SUSE Linux Enterprise Server 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Desktop 15 SP6 | Affected |
| SUSE Linux Enterprise Workstation Extension 15 SP6 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today