EUVD-2026-114319
GHSA-q73j-x4hx-9236
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted AV1 media to target
-
ExploitUser/app processes stream in GStreamer
-
ExecutionInteger overflow in LEB128 parser
-
ImpactIncorrect length used, application crash (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target application to decode or parse an attacker-supplied AV1 bitstream using GStreamer's AV1 LEB128 variable-length integer parser; the trigger is a crafted invalid LEB128-encoded value that overflows during length computation. The key limiting factor is UI:R - a user or application must actively open, play, or preview the malicious AV1 media, so there is no passive server-side exposure. No authentication is needed (PR:N, so unauthenticated), but impact is confined to a crash (availability only), with no path to code execution or data disclosure described in the available sources. |
| Impact | This is a medium-severity, availability-only issue (CVSS 6.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - an integer overflow (CWE-190) in GStreamer's AV1 LEB128 parser that leads to a denial of service, not code execution. Despite the integer-overflow class often implying memory corruption, the description and vector agree the impact is limited to a crash (C:N/I:N/A:H), so this is not a 'high-CVSS-but-hidden-RCE' case. Exploitation is network-reachable (AV:N) and needs no privileges (PR:N), but requires user interaction (UI:R): a user or application must actually process the malicious AV1 media, which meaningfully lowers real-world risk versus a fully unauthenticated server-side flaw. The vuln.today decision label is 'this_month' (not act_now/emergency). No EPSS score, no CISA KEV listing, and no public exploit reference were provided in the input, so there is no signal of active or widespread exploitation; priority should be driven by the broad GStreamer footprint rather than by urgency signals. Net: a legitimate but non-emergency patching item - schedule within the normal monthly cycle. |
| Exploit ScenarioDerived | An attacker crafts a malformed AV1 bitstream with an invalid LEB128-encoded length value and delivers it as a media file, stream, or webpage resource. When a victim's application built on GStreamer decodes or previews the content (UI:R), the integer overflow produces an incorrect length during stream processing and crashes the application. No public exploit was identified at time of analysis, and the outcome is denial of service only - no code execution or data disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
GStreamer's AV1 LEB128 parser can overflow when it processes a crafted AV1 bitstream, causing applications that decode or preview the media to crash. An unauthenticated remote attacker can trigger the overflow by supplying malformed AV1 content, but a user or application must open or preview it, and impact is limited to denial of service on Red Hat Enterprise Linux 6, 7, 8, 9, and 10 deployments. No public exploit has been identified at time of analysis.
RemediationAI
Apply the GStreamer updates released for the affected Red Hat Enterprise Linux branches; the upstream fix is tracked in GStreamer merge request 11245 and described in GStreamer security advisory SA-2026-0014, while the corresponding Red Hat errata and exact fixed package versions should be confirmed on the Red Hat CVE page and Bugzilla 2564126. Upstream fix available (PR/commit); released patched version not independently confirmed. Until updates are applied, limit exposure by preventing GStreamer-based applications from opening or previewing untrusted AV1 media, since exploitation requires a crafted AV1 bitstream to be parsed; monitor the GStreamer advisory and Red Hat advisory for version-specific guidance.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GStreamer is a multimedia framework whose AV1 handling includes parsing LEB128 variable-length integers from AV1 bitstreams. CWE-190 describes the root cause: an integer overflow in that LEB128 parser produces incorrect length values during stream processing, and the supplied CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) matches an availability-only crash reached through network-delivered media with no privileges required and user interaction required. CPE data maps package exposure to Red Hat Enterprise Linux 10, 6, 7, and 8, and the associated tags also name Red Hat Enterprise Linux 9; the upstream references are GStreamer merge request 11245 and security advisory SA-2026-0014. The trigger is a malformed LEB128-encoded value, and the sources do not describe code execution or data disclosure.
Know when Gstreamer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Malicious AV1 content is network-deliverable (AV:N) and needs no privileges (PR:N) but must be processed by the victim (UI:R); impact is crash-only, so C:N/I:N/A:H.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to
A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
Exploit-DB