GStreamer gst-plugins-good EUVD-2026-102937

Exploitation requires an application built on gst-plugins-good to decode or demux attacker-controlled media data using the affected element; the flaw is in media parsing, so the attacker must supply a crafted file or stream that reaches that code path. Limiting factors: in typical desktop playback a user must open/play the malicious media (contradicting the vendor's UI:N, which fits only unattended server-side pipelines such as transcoders, streaming servers, or thumbnailers); impact is confined to memory disclosure (C:H, I:N, A:N) with no confirmed code execution; and only versions prior to the gst-plugins-good 1.26.3 fix (Alpine 1.26.3-r0) are affected. The precise vulnerable element and configuration are detailed only in GStreamer advisory sa-2026-0018, which was not included in the provided data.

The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N, base 7.5) frames this CWE-125 out-of-bounds read as a network-reachable, unauthenticated, low-complexity information-disclosure flaw in GStreamer's gst-plugins-good plugin set. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 7.5 is a severity rating, not an exploitation signal. A key tension exists: GStreamer media elements are most commonly driven by a user opening or playing a crafted media file, which would normally imply UI:R, yet the vendor marked UI:N; this is defensible only for automated/server-side pipelines (streaming servers, transcoders, thumbnailers) that decode untrusted media without interaction - verify the real deployment context before treating this as fully drive-by. The impact is bounded: C:H with I:N/A:N means memory disclosure only, with no confirmed code execution or availability loss, so this is a meaningful but not top-tier priority - prioritize patching where GStreamer auto-processes untrusted input, and treat it as moderate on desktop playback paths that require user action.

An attacker crafts a malformed media file or stream that, when decoded by an application using the affected gst-plugins-good element, triggers an out-of-bounds read past a buffer boundary, leaking adjacent heap memory into the processing context. In an automated pipeline (e.g., a server-side transcoder or thumbnail generator) this can occur without user interaction, consistent with the stated AV:N/UI:N vector. No public proof-of-concept was provided with this data.