Gstreamer EUVD-2026-12117

| CVE-2026-2922 HIGH

Out-of-bounds Write (CWE-787)

2026-03-13 zdi

RCE Buffer Overflow Memory Corruption Gstreamer

7.8

CVSS 3.1 · Vendor: zdi

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious RealMedia video file
Exploit

Open file with GStreamer application
Execution

Trigger out-of-bounds write in demuxer
Impact

Execute arbitrary code

Vulnerability Assessment

Weakness	CWE CWE-787 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	GStreamer library with RealMedia demuxer enabled processing untrusted .rm or .rmvb files; user interaction required to open malicious media file via GStreamer-based application
Impact	Despite the high CVSS score of 7.8, the real-world risk is moderate. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates local attack vector with required user interaction, limiting remote exploitation potential. The vulnerability requires an attacker to convince a user to open a malicious RealMedia file. No EPSS score or KEV listing suggests low active exploitation probability. The ZDI disclosure (ZDI-CAN-28845) indicates responsible disclosure rather than in-the-wild activity. While the technical impact is severe (arbitrary code execution), the exploitation barrier of requiring user interaction significantly reduces the practical risk compared to remotely exploitable vulnerabilities.
Exploit ScenarioDerived	An attacker crafts a malicious RealMedia file containing specially formatted video packets that trigger the buffer overflow when parsed by GStreamer. The attack requires distributing this file through email, web downloads, or removable media and convincing a user to open it in a GStreamer-based media player. Upon processing the malformed video packets, the out-of-bounds write corrupts memory, allowing the attacker to execute arbitrary code with the privileges of the media player process. No public proof-of-concept is mentioned, but the detailed ZDI advisory suggests the vulnerability is well-understood.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Mar 13, 2026

Critical remote code execution vulnerability in GStreamer's RealMedia demuxer component, allowing attackers to execute arbitrary code via malformed video packets that trigger an out-of-bounds write. The vulnerability affects all versions of GStreamer (CPE indicates wildcard versioning) and requires user interaction to process malicious media files. While no active exploitation is reported (not in KEV), the availability of a vendor patch and ZDI advisory suggests this vulnerability has been responsibly disclosed and addressed.

RemediationAI

Apply the official patch available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/88df8d2cd063b95a076e8041b47f778a4402f363. Users should update to the latest patched version of GStreamer through their distribution's package manager or rebuild from source with the patch applied. As a temporary mitigation, disable or remove the RealMedia demuxer plugin if RealMedia file support is not required, or implement strict input validation for media files from untrusted sources.

Affected VersionsENISA

GStreamer 1c6e163aa33962f5ee4a87d29319ccdd5cb67612

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

The vulnerability exists in GStreamer, an open-source multimedia framework widely used in Linux distributions and applications for media playback. According to the CPE string (cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*), all versions are potentially affected. The flaw is classified as CWE-787 (Out-of-bounds Write), occurring specifically in the RealMedia demuxer component when processing video packets. This type of memory corruption vulnerability allows writing data beyond allocated buffer boundaries, potentially overwriting critical memory regions and enabling arbitrary code execution.

Know when Gstreamer gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (zdi) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE HIGH

Red Hat 7.8 HIGH

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of video packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28845.

Zero Day Initiative Advisories

ZDI-26-165 GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability Mar 2026

Executive ViewAI

Why It Matters

CVE-2026-2922 is a high-severity remote code execution vulnerability in GStreamer that could allow attackers to execute arbitrary code on systems processing malicious video files. This poses a significant risk to organizations whose users consume media content or operate systems with GStreamer-dependent applications, potentially compromising confidentiality, integrity, and availability of affected systems.

Business Impact: High

Compensating Controls

Disable RealMedia (.rm, .rmvb) demuxer in GStreamer configuration; restrict user ability to open arbitrary media files from untrusted sources; implement network segmentation isolating systems that process media content; deploy endpoint detection and response (EDR) monitoring for code execution anomalies; enforce application whitelisting; require user training on malicious file risks; block .rm and .rmvb file extensions at email and web gateways if not business-critical.

Threat Intelligence Overview

EPSS Score

0.1%

Top 81% exploitable

Data Quality

6 sources

Confidence: High

EUVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

No

Human Impact

High

Priority Score

39

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Related Vulnerabilities in GStreamer Media Parsing Buffer Overflow and Integer Overflow

View all 10

CVE-2026-3081 HIGH

CVE-2026-3082 HIGH

CVE-2026-2920 HIGH

CVE-2026-2921 HIGH

CVE-2026-2923 HIGH

CVE-2026-3083 HIGH

CVE-2026-3084 HIGH

CVE-2026-3085 HIGH

CVE-2026-3086 HIGH

More in Gstreamer

View all

CVE-2016-9636 CRITICAL Emergency POC

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9635 CRITICAL Emergency POC

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9634 CRITICAL Emergency POC

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9808 HIGH This Week POC

The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an

CVE-2019-9928 HIGH Act Now

A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to

CVE-2025-47219 HIGH This Week POC

A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun

CVE-2022-1920 HIGH This Week POC

An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption

CVE-2022-2122 HIGH This Week POC

A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o

CVE-2022-1924 HIGH This Week POC

A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia

CVE-2022-1922 HIGH This Week POC

An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory

CVE-2022-1921 HIGH This Week POC

An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par

CVE-2022-1925 HIGH This Week POC

A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska

Same weakness CWE-787 – Out-of-bounds Write

View all

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2012-1889 HIGH POC

CVE-2010-3333 HIGH POC

CVE-2014-1761 HIGH POC

CVE-2009-3129 HIGH POC

CVE-2021-1732 HIGH POC

CVE-2013-3346 CRITICAL POC

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

CVE-2017-7269 CRITICAL POC

CVE-2022-47966 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2023-3519 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2016-4117 CRITICAL POC

Vendor StatusVendor

SUSE

Severity: High

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.70 Container suse/sl-micro/6.0/base-os-container:2.1.3-7.38 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.62 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.72 Image SL-Micro	Affected
Container suse/sl-micro/6.0/toolbox:13.2-9.23	Affected
Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd	Affected
SUSE Liberty Linux 10	Fixed
SUSE Liberty Linux 9	Fixed

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:6259 ADVISORY https://access.redhat.com/errata/RHSA-2026:6300 ADVISORY https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/88df8d2cd063b95a076e8041b47f778a4402f363 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-2922 ADVISORY https://ubuntu.com/security/notices/USN-8896-1 ADVISORY https://vuldb.com/?id.349621 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0998/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20915/ REF https://access.redhat.com/errata/RHSA-2026:19024 REF https://access.redhat.com/errata/RHSA-2026:19180 REF https://access.redhat.com/errata/RHSA-2026:8854 REF https://access.redhat.com/errata/RHSA-2026:8862 REF https://access.redhat.com/security/cve/CVE-2026-2922 REF https://bugzilla.redhat.com/show_bug.cgi?id=2447500 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2922.json REF https://www.zerodayinitiative.com/advisories/ZDI-26-165/

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy