Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach DTLS-enabled GStreamer endpoint
  2. Delivery
    Initiate DTLS handshake as peer
  3. Exploit
    Present certificate with oversized Subject DN
  4. Execution
    DN copied into 2048-byte stack buffer
  5. Persist
    Stack buffer overflow corrupts memory
  6. Impact
    Media process crashes (denial of service)

Vulnerability Assessment

Weakness
CWE
CWE-121
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the target application actually run the GStreamer DTLS plugin and perform a DTLS handshake with an attacker-controlled peer - i.e., a WebRTC/DTLS-terminating deployment (webrtcbin/dtls elements) reachable by the attacker. The concrete trigger is a peer certificate carrying a Subject Distinguished Name larger than the fixed 2048-byte stack buffer, delivered during the handshake before authentication completes (PR:N, no user interaction). Limiting factors: GStreamer installs that never negotiate DTLS/WebRTC do not expose the vulnerable code path; the media endpoint must be network-reachable by an untrusted peer; and impact is confined to a crash (availability), not code execution or data disclosure, so successful exploitation yields denial of service only.
Impact

The signals are consistent and point to a genuine but bounded (availability-only) risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction, but impact confined to availability - matching the description of a crash/DoS with no confidentiality or integrity loss. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis; the vulnerability is not confirmed actively exploited. Practical risk depends heavily on exposure: the DTLS plugin is only reachable in deployments that actually terminate DTLS/WebRTC (media servers, SFUs, gateways). A DoS against such a service is meaningful for availability but does not enable takeover. Net: a real priority for anyone running GStreamer-based WebRTC/DTLS endpoints exposed to untrusted peers, and low practical relevance for GStreamer installs that never negotiate DTLS.
Exploit ScenarioDerived

An attacker points a malicious DTLS/WebRTC peer at a GStreamer-based media endpoint (for example a webrtcbin-powered conferencing SFU) and initiates a handshake, presenting a certificate whose Subject Distinguished Name is padded well beyond 2048 bytes. When the DTLS plugin formats the DN into its fixed stack buffer, the overflow corrupts the stack and crashes the media process, dropping all active sessions. The low attack complexity and lack of authentication (AV:N/AC:L/PR:N) make this a simple, repeatable denial of service; no public exploit is identified at this time.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 09, 2026

Denial of service in GStreamer's DTLS plugin allows a remote unauthenticated attacker to crash any application that performs a DTLS handshake (notably WebRTC/webrtcbin pipelines) by presenting a TLS certificate with an oversized Subject Distinguished Name. The Subject DN is written into a fixed 2048-byte stack buffer with no bounds checking (CWE-121), and overflowing it corrupts the stack and terminates the process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; impact is limited to availability (process crash), with no code execution or data exposure claimed.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the GStreamer security update once your distribution ships it. Red Hat users should update the affected GStreamer packages when RHEL 6/7/8/9/10 errata are published; track https://access.redhat.com/security/cve/CVE-2026-59692 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2497344 for the exact fixed builds, and reference the upstream change at https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/99. Until patched, reduce exposure by not accepting DTLS handshakes from untrusted peers: where the application permits, disable or unload the GStreamer DTLS plugin if WebRTC/DTLS is not needed (side effect: breaks WebRTC media), or place the media endpoint behind an authenticating gateway/TURN relay and restrict which peers can initiate DTLS (side effect: limits legitimate peer reachability). Network-layer filtering of the media/DTLS ports to known peers reduces attack surface but does not fix the underlying overflow.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GStreamer is the widely used open-source multimedia framework that powers audio/video pipelines across Linux desktops, embedded devices, and server-side media processing. The affected component is the DTLS plugin, which implements Datagram TLS used to secure media transport in WebRTC (SRTP key exchange via the webrtcbin/dtls elements). During the DTLS handshake, the plugin extracts the peer certificate's Subject Distinguished Name for logging/inspection and formats it into a fixed-size 2048-byte buffer allocated on the stack. Because the copy performs no length validation, an attacker-controlled certificate whose Subject DN exceeds 2048 bytes writes past the buffer boundary - a classic CWE-121 stack-based buffer overflow. Since certificates are supplied by the remote peer before authentication completes, the flaw is reachable pre-authentication. Red Hat CPE data attributes the affected packages to Red Hat Enterprise Linux 6 through 10 (the distro-shipped GStreamer builds), and the root fix lives upstream in the freedesktop GStreamer project.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Remote unauthenticated peer triggers the overflow during handshake with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is a crash only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service.

Executive ViewAI

Why It Matters

GStreamer's DTLS plugin is vulnerable to remote denial-of-service attacks that crash applications performing WebRTC communications or DTLS handshakes. An attacker can trigger crashes by presenting a malicious TLS certificate, creating availability disruptions for organizations relying on GStreamer for video conferencing, streaming, or real-time communication platforms. No public exploit code is currently known, limiting immediate exploitation risk.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include: (1) network segmentation to limit exposure to untrusted peers, (2) monitoring and alerting on application crashes correlated with DTLS handshakes, (3) disabling DTLS/WebRTC if not operationally required, (4) implementing input validation or rate limiting on connection attempts if application logic permits.

Threat Intelligence Overview

EPSS Score
0.3%
Top 77% exploitable
Prevalence
High
core multimedia framework across Linux desktops and media servers
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Stack-based Buffer Overflow HIGH

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-59692 ADVISORY https://vuldb.com/vuln/377190 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3058/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3125/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3133/ REF https://access.redhat.com/errata/RHSA-2026:47179 REF https://access.redhat.com/errata/RHSA-2026:47180 REF https://access.redhat.com/errata/RHSA-2026:47731 REF https://access.redhat.com/errata/RHSA-2026:54658 REF https://access.redhat.com/errata/RHSA-2026:54659 REF https://access.redhat.com/errata/RHSA-2026:54660 REF https://access.redhat.com/errata/RHSA-2026:54664 REF https://access.redhat.com/errata/RHSA-2026:54665 REF https://access.redhat.com/errata/RHSA-2026:54752 REF https://access.redhat.com/errata/RHSA-2026:56658 REF https://access.redhat.com/errata/RHSA-2026:56772 REF https://access.redhat.com/security/cve/CVE-2026-59692 REF https://bugzilla.redhat.com/show_bug.cgi?id=2497344 REF https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/99 REF https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5172

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy