EUVD-2026-100950
GHSA-8f88-phh5-g894
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local foothold as pipeline sender
-
DeliveryCraft buffer with oversized GstVideoMeta strides/offsets
-
ExploitDeliver buffer over GStreamer IPC
-
ExecutionReceiver maps frame without range check
-
PersistHeap out-of-bounds read/write
-
ImpactCrash or code execution in receiving process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a GStreamer inter-process (IPC) pipeline in which the attacker controls the sending/producer side and can emit buffers carrying attacker-fabricated GstVideoMeta metadata; the receiving process must map the video frame, at which point unchecked plane strides/offsets exceeding the backing allocation trigger the overflow. Limiting factors: exploitation is strictly local (AV:L) with no remote/network path, and it depends on a deployment that actually uses GStreamer IPC between a less-trusted sender and a more-trusted receiver, so hosts not running such cross-process media pipelines are not exposed. No user interaction and no authentication to the victim process are needed (PR:N/UI:N). |
| Impact | Signals are moderately consistent and point to a serious-but-not-emergency issue. The provided CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.4 High) is internally coherent with the description: exploitation is local, requiring the attacker to control the sending side of a GStreamer inter-process pipeline, with high impact to confidentiality, integrity and availability (heap out-of-bounds read/write, CWE-787). No EPSS score, CISA KEV listing, or public POC was provided, so exploitation status is: no public exploit identified at time of analysis. The local-only attack vector (AV:L) materially caps real-world risk versus a network-exploitable RCE of the same score - an attacker must already run code or control a process feeding the victim pipeline. The C:H/I:H/A:H impact and the 'potentially allow code execution' language justify treating it as a real priority for multimedia-processing and desktop hosts, but it is better characterized as a local privilege/sandbox-escape or DoS primitive than a remotely wormable flaw. Absence of EPSS/KEV/POC is expected for a freshly reported Red Hat vulnerability and should not be read as proof of low interest. |
| Exploit ScenarioDerived | A local, unprivileged process that feeds buffers into a shared GStreamer IPC pipeline (for example via inter-process sink/source elements) crafts a video buffer whose GstVideoMeta declares plane strides and offsets larger than the real allocation. When the receiving GStreamer process maps the video frame, the unchecked geometry causes it to read or write past the heap allocation, crashing the consumer (DoS) or potentially corrupting heap memory toward code execution in that process. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Heap-based buffer overflow in GStreamer's gst-plugins-base plugin library lets a local attacker who controls the sending side of a GStreamer inter-process IPC pipeline corrupt memory in the receiving process, yielding a CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact. The victim process maps a crafted video buffer whose GstVideoMeta declares plane strides and offsets larger than the actual backing allocation, causing out-of-bounds reads and writes that can crash the process or potentially permit code execution in its context. Exploitation is strictly local and requires a deployment where GStreamer buffers cross a trust boundary between a less-trusted producer and a more-trusted consumer; no user interaction or authentication to the victim is needed, and no public exploit has been identified at time of analysis.
RemediationAI
No vendor-released patch was identified in the available intelligence at time of analysis; the Red Hat CVE page (https://access.redhat.com/security/cve/CVE-2026-86476), Bugzilla entry (https://bugzilla.redhat.com/show_bug.cgi?id=2529510), and PSIRT record (https://redhat.atlassian.net/browse/PSIRTSUPT-23320) should be monitored for the fixed gst-plugins-base package versions and applied as soon as they are published via the normal RHEL errata channels. Until then, the highest-value control is to eliminate the trust asymmetry the flaw depends on: do not let untrusted or less-privileged producers feed GStreamer buffers into a more-privileged receiving process, and instead keep both ends of any IPC media pipeline within the same trust domain or in a dedicated unprivileged user. Where such pipelines are unavoidable, sandbox the receiving GStreamer process so out-of-bounds writes cannot reach sensitive memory - for example, run it under SELinux or AppArmor confinement with a minimal policy, drop capabilities, and place it in a separate mount and network namespace; the trade-off is that media access (device nodes, shared memory segments, sockets) must be granted explicitly and may break ingest pipelines. Restricting or disabling GStreamer IPC-based elements (for example, refusing exogenous buffers from untrusted peers in application code, or disabling the affected plugins on hosts that do not require them) removes the attack surface entirely, at the cost of losing cross-process media sharing. Finally, enabling allocator hardening such as glibc malloc checking or a hardened/scrubbing allocator can convert some corruptions into immediate aborts, reducing the chance of code execution, but this is a probabilistic mitigation that degrades performance and is not a substitute for the vendor fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is the multimedia framework underlying many Linux desktop and server media stacks, and gst-plugins-base supplies the core video buffer, caps, and video metadata handling. The flaw is an out-of-bounds write (CWE-787) in which GstVideoMeta, the structure that describes video frame layout (plane count, per-plane strides and offsets, format), is deserialized without validating that the declared plane geometry actually fits inside the attached GstBuffer's memory allocation. When the buffer is later mapped for reading or writing by a downstream consumer, the mapping code trusts the fabricated strides and offsets and walks past the end of the heap allocation. Because the metadata travels with the serialized IPC buffer, an attacker on the producer side of an inter-process or cross-process pipeline can supply arbitrary stride and offset values. The assessed vector AV:L/AC:L/PR:N/UI:N confirms the attack is local to the host (no network vector), requires no authentication and no user interaction, and is otherwise low-complexity once the attacker can emit buffers into a GStreamer IPC pipeline. The Red Hat CPE data maps exposure to gst-plugins-base packages shipped across Red Hat Enterprise Linux 6, 7, 8, 9, and 10.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
A local IPC sender needs no privilege against the victim process (AV:L, PR:N); unchecked metadata makes triggering straightforward (AC:L); heap read/write yields C/I/A High within the same process (S:U).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.
Executive ViewAI
A memory-corruption flaw in GStreamer's gst-plugins-base library can be triggered by any local process that feeds crafted media buffers into a more-trusted consuming application, giving that lower-privileged producer a path to crash - or potentially execute code within - the victim process. Because the flaw crosses a producer/consumer trust boundary and requires no authentication or user interaction, any environment that pipes untrusted media into privileged GStreamer-based services (media gateways, transcoding pipelines, desktop agents, or containerized streaming workloads) carries elevated risk. No vendor patch is currently available, so leadership should treat this as a containment problem rather than a patching problem until the vendor ships a fix.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce strict trust-boundary separation so untrusted local processes cannot act as producers into privileged GStreamer consumers; run all media-consuming processes as unprivileged, isolated service accounts or containers with seccomp/AppArmor/SELinux confinement and dropped capabilities; disable or block unused GStreamer IPC paths and untrusted plugins; apply OS-level memory protections (ASLR, hardened allocators) and monitor consumer processes for crashes or unexpected memory faults.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
Exploit-DB