Skip to main content

Gstreamer EUVDEUVD-2026-12125

| CVE-2026-3083 HIGH
Improper Validation of Array Index (CWE-129)
2026-03-13 zdi
Buffer Overflow RCE Gstreamer
8.8
CVSS 3.1 · Vendor: zdi
Share

Severity by source

Vendor (zdi) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
8.8 HIGH
qualitative

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
EUVD ID Assigned
Mar 13, 2026 - 21:01 euvd
EUVD-2026-12125
Analysis Generated
Mar 13, 2026 - 21:01 vuln.today
CVE Published
Mar 13, 2026 - 20:41 nvd
HIGH 8.8

DescriptionCVE.org

GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of X-QDM RTP payload elements. When parsing the packetid element, the process does not properly validate user-supplied data, which can result in a write past the end of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28850.

AnalysisAI

Critical out-of-bounds write vulnerability in GStreamer's rtpqdm2depay component that allows remote code execution when processing malformed X-QDM RTP payloads. The vulnerability affects all versions of GStreamer (CPE shows wildcard versioning) and requires user interaction, though attack vectors vary by implementation. With a CVSS score of 8.8 and active patch available, this represents a significant risk for applications using GStreamer for media processing.

Technical ContextAI

The vulnerability occurs in GStreamer's RTP (Real-time Transport Protocol) depayloader for QDM2 audio codec streams, specifically in the rtpqdm2depay element. When parsing the packetid element from X-QDM RTP payloads, the code fails to properly validate array bounds, leading to CWE-129 (Improper Validation of Array Index). This allows writing data past the end of an allocated array, corrupting adjacent memory. GStreamer is a widely-used multimedia framework (CPE: cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*) employed in numerous applications for audio/video streaming and processing.

RemediationAI

Apply the official patch commit d60a94dee3c0a0942c9981491bf83e0de1900fbf from the GStreamer GitLab repository (https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d60a94dee3c0a0942c9981491bf83e0de1900fbf). Users should update to the latest patched version of GStreamer that includes this fix. As a temporary workaround, disable or block processing of X-QDM RTP streams if this functionality is not required. Monitor the Zero Day Initiative advisory ZDI-26-166 for additional updates.

More in Gstreamer

View all
CVE-2016-9636 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9635 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9634 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9808 HIGH POC
7.5 Jan 13

The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
CVE-2019-9928 HIGH
8.8 Apr 24

A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to

CVE-2022-1920 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
CVE-2022-2122 HIGH POC
7.8 Jul 19

A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
CVE-2022-1924 HIGH POC
7.8 Jul 19

A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
CVE-2022-1922 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
CVE-2022-1921 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
CVE-2022-1925 HIGH POC
7.8 Jul 19

A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska
CVE-2022-1923 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's matroska demuxer can cause denial of service through segmentation fault

Same weakness CWE-129 – Improper Validation of Array Index

View all
CVE-2016-9053 CRITICAL POC
9.8
CVE-2020-27485 CRITICAL POC
9.9
CVE-2020-27483 CRITICAL POC
9.9
CVE-2024-24563 CRITICAL POC
9.8
CVE-2017-8797 HIGH
7.5
CVE-2018-11489 HIGH POC
8.8
CVE-2026-56770 HIGH POC
8.7
CVE-2017-7228 HIGH POC
8.2

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-12125 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy