Skip to main content

Gstreamer EUVDEUVD-2026-12127

| CVE-2026-3084 HIGH
Integer Underflow (CWE-191)
2026-03-13 zdi
RCE Integer Overflow Gstreamer
7.8
CVSS 3.1 · Vendor: zdi
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious H.266 video file
  2. Delivery
    Open file in GStreamer application
  3. Exploit
    Trigger integer underflow in picture partition parser
  4. Execution
    Write to memory
  5. Impact
    Execute arbitrary code

Vulnerability Assessment

Weakness
CWE
CWE-191
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
Exploitation Conditions

GStreamer library with H.266 codec parser enabled. User must open or play attacker-controlled H.266 video file in application using vulnerable GStreamer (local exploitation requiring user interaction).
Impact

Despite the high CVSS score of 7.8, the real-world risk is moderated by several factors. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates local attack vector with required user interaction, meaning an attacker cannot remotely exploit this without user action. The vulnerability is not listed in CISA KEV, indicating no known active exploitation. Without EPSS data provided, we cannot assess the statistical likelihood of exploitation. The SSVC framework would likely categorize this as 'Attend' rather than 'Act' priority due to: no evidence of active exploitation, requirement for user interaction (not fully automatable), and while technical impact is total (code execution), the attack surface is limited to applications processing H.266 content. This represents a legitimate security issue requiring patching but not an emergency response.
Exploit ScenarioDerived

An attacker would need to craft a malicious H.266 video file with specially manipulated picture partition data designed to trigger the integer underflow. The victim must then open or process this file using a vulnerable GStreamer-based application. Upon parsing the malformed partitions, the integer underflow causes memory corruption, allowing the attacker to hijack program execution. Attack vectors could include malicious video files distributed via email, web downloads, or streaming services. No public proof-of-concept exists, but the Zero Day Initiative disclosure suggests the vulnerability is practically exploitable. The local attack vector and user interaction requirement limit mass exploitation potential.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 13, 2026

CVE-2026-3084 is an integer underflow vulnerability in GStreamer's H.266 codec parser that allows remote code execution when processing malicious media files. The vulnerability affects all versions of GStreamer (CPE indicates wildcard versioning) and can be exploited through user interaction with specially crafted H.266 video content, allowing attackers to execute arbitrary code in the context of the application. No active exploitation (not in KEV) or public POC has been reported, and the relatively high CVSS score (7.8) is tempered by the local attack vector and user interaction requirement.

RemediationAI

Apply the patch commit available at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/496e4f296e658fba7fd40027d3bbe6095633ec91. Organizations should update to the latest patched version of GStreamer that includes this fix. As a temporary mitigation, disable H.266/VVC codec support in GStreamer if this functionality is not required, or implement input validation for H.266 content sources. Monitor the Zero Day Initiative advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-169/ for additional updates.

Affected VersionsENISA

GStreamer 1c6e163aa33962f5ee4a87d29319ccdd5cb67612

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GStreamer is an open-source multimedia framework widely used for building media handling components in applications. The vulnerability occurs specifically in the H.266 (Versatile Video Coding/VVC) codec parser when processing picture partitions. As a CWE-191 (Integer Underflow) vulnerability, the flaw arises from insufficient validation of user-supplied data during partition parsing, causing an integer value to wrap below its minimum value. This underflow subsequently leads to incorrect memory calculations and out-of-bounds memory writes. The affected product CPE (cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*) indicates all versions are potentially vulnerable until patched.

Know when Gstreamer gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (zdi) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 7.8 HIGH

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

GStreamer H.266 Codec Parser Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of picture partitions. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28910.

Zero Day Initiative Advisories

ZDI-26-169 GStreamer H.266 Codec Parser Integer Underflow Remote Code Execution Vulnerability Mar 2026

Executive ViewAI

Why It Matters

CVE-2026-3084 is a remote code execution vulnerability in GStreamer's H.266 video codec parser that could allow attackers to compromise systems when users open malicious video files. While no active exploitation has been observed and a patch is unavailable, organizations relying on GStreamer for media processing should prepare mitigation strategies to reduce exposure.

Business Impact: Medium
Compensating Controls

Disable H.266 codec support in GStreamer if not operationally required; implement file-type validation and sandboxing for media file processing; restrict H.266 video file uploads and sharing; segment systems processing user-supplied media from critical infrastructure; enforce application whitelisting; provide user security awareness training on media file risks. Monitor GStreamer security advisories for patch availability.

Threat Intelligence Overview

EPSS Score
0.1%
Top 81% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Related Vulnerabilities in GStreamer Media Parsing Buffer Overflow and Integer Overflow

View all 10
CVE-2026-3081 HIGH
7.8
CVE-2026-3082 HIGH
7.8
CVE-2026-2920 HIGH
7.8
CVE-2026-2921 HIGH
7.8
CVE-2026-2922 HIGH
7.8
CVE-2026-2923 HIGH
7.8
CVE-2026-3083 HIGH
8.8
CVE-2026-3085 HIGH
8.8
CVE-2026-3086 HIGH
7.8

More in Gstreamer

View all
CVE-2016-9636 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9635 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9634 CRITICAL POC
9.8 Jan 27

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9808 HIGH POC
7.5 Jan 13

The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an
CVE-2019-9928 HIGH
8.8 Apr 24

A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to

CVE-2025-47219 HIGH POC
8.1 Aug 07

A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun
CVE-2022-1920 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption
CVE-2022-2122 HIGH POC
7.8 Jul 19

A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o
CVE-2022-1924 HIGH POC
7.8 Jul 19

A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia
CVE-2022-1922 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory
CVE-2022-1921 HIGH POC
7.8 Jul 19

An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par
CVE-2022-1925 HIGH POC
7.8 Jul 19

A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska

Same weakness CWE-191 – Integer Underflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2015-5212 MEDIUM
6.8
CVE-2017-14496 HIGH POC
7.5
CVE-2014-8768 MEDIUM POC
5.0
CVE-2017-11757 CRITICAL POC
9.8
CVE-2024-23313 CRITICAL POC
9.8
CVE-2021-3323 CRITICAL POC
9.8
CVE-2021-21811 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/496e4f296e658fba7fd40027d3bbe6095633ec91 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-3084 ADVISORY https://vuldb.com/?id.349626 REF https://access.redhat.com/security/cve/CVE-2026-3084 REF https://bugzilla.redhat.com/show_bug.cgi?id=2447483 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3084.json REF https://www.zerodayinitiative.com/advisories/ZDI-26-169/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy