Gstreamer EUVD-2026-12129

| CVE-2026-3085 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-03-13 zdi

RCE Buffer Overflow Heap Overflow Gstreamer

8.8

CVSS 3.1 · Vendor: zdi

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Attacker sends malicious RTP packet with X-QDM payload
Exploit

rtpqdm2depay processes payload without length validation
Execution

Heap buffer overflow occurs
Impact

Arbitrary code execution with user privileges

Vulnerability Assessment

Weakness	CWE CWE-122 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Heap buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	GStreamer library with rtpqdm2depay plugin enabled and active processing of RTP streams containing X-QDM payloads. Requires user interaction to initiate RTP stream processing (e.g., opening malicious media file or stream URI).
Impact	The CVSS 3.0 score of 8.8 (High) reflects significant theoretical risk with network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), but crucially requires user interaction (UI:R). Without EPSS data or KEV listing, there's no evidence of active exploitation in the wild. The vulnerability requires an attacker to deliver malicious RTP payloads that must be processed by a vulnerable GStreamer instance, limiting practical exploitation to scenarios where attackers can inject media streams. While the technical impact is severe (remote code execution with high confidentiality/integrity/availability impact), the user interaction requirement and specific protocol targeting significantly reduce the likelihood of widespread exploitation compared to other network-accessible RCEs.
Exploit ScenarioDerived	An attacker could craft malicious X-QDM encoded media content delivered via RTP protocol, embedding oversized data that triggers the buffer overflow when processed by the vulnerable rtpqdm2depay element. This could occur through scenarios like: a malicious media file opened in a vulnerable media player, a compromised streaming server delivering malformed content, or injection of malicious RTP packets in a video conferencing session. Successful exploitation would allow the attacker to execute arbitrary code with the privileges of the process running GStreamer. While no public proof-of-concept is mentioned, the Zero Day Initiative advisory (ZDI-26-167) suggests this was discovered through their bug bounty program.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Mar 13, 2026

Heap-based buffer overflow vulnerability in GStreamer's rtpqdm2depay component that allows remote attackers to execute arbitrary code when processing malformed X-QDM RTP payloads. The vulnerability affects all versions of GStreamer (CPE indicates no version restrictions) and requires user interaction to exploit, though attack vectors may vary based on implementation. No active exploitation is known (not in KEV), and no EPSS score is available to assess real-world exploitation probability.

RemediationAI

A patch is available as indicated by the GitLab commit reference (https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d60a94dee3c0a0942c9981491bf83e0de1900fbf). Users should update to a GStreamer version that includes this commit. As a temporary mitigation, disable or block processing of X-QDM RTP streams if this functionality is not required. Organizations should audit their GStreamer deployments and prioritize patching systems that process untrusted media streams or are exposed to external inputs.

Affected VersionsENISA

GStreamer 1c6e163aa33962f5ee4a87d29319ccdd5cb67612

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

The vulnerability exists in GStreamer's RTP (Real-time Transport Protocol) depayloader for X-QDM (Qualcomm's QDM codec) streams, specifically in the rtpqdm2depay element. This is a classic heap buffer overflow (CWE-122) where the application fails to properly validate the length of user-supplied data before copying it to a heap-allocated buffer. GStreamer is a widely-used multimedia framework that processes audio and video streams, and the affected CPE (cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*) indicates all versions are potentially vulnerable. The flaw was originally tracked as ZDI-CAN-28851 by Zero Day Initiative before receiving its CVE designation.

Know when Gstreamer gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (zdi) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE HIGH

Red Hat 8.8 HIGH

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the processing of X-QDM RTP payloads. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28851.

Zero Day Initiative Advisories

ZDI-26-167 GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability Mar 2026

Executive ViewAI

Why It Matters

A heap-based buffer overflow in GStreamer's RTP audio processing component could allow attackers to execute arbitrary code on systems processing malformed media streams. Organizations using GStreamer for audio/video processing or streaming applications face potential data breach, service disruption, or system compromise if exploited, though active attacks are not currently documented.

Business Impact: High

Compensating Controls

Disable rtpqdm2depay component if not required for operations; restrict RTP stream sources to trusted, authenticated endpoints using network access controls; implement WAF/IPS rules to detect malformed X-QDM RTP payloads; isolate affected systems on segmented networks; run GStreamer processes with minimal privilege and sandboxing; monitor application logs for RTP processing errors. Monitor CVE-2026-3085 for patch release and apply immediately upon availability.

Threat Intelligence Overview

EPSS Score

0.3%

Top 52% exploitable

Data Quality

6 sources

Confidence: High

EUVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

No

Human Impact

High

Priority Score

44

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Related Vulnerabilities in GStreamer Media Parsing Buffer Overflow and Integer Overflow

View all 10

CVE-2026-3081 HIGH

CVE-2026-3082 HIGH

CVE-2026-2920 HIGH

CVE-2026-2921 HIGH

CVE-2026-2922 HIGH

CVE-2026-2923 HIGH

CVE-2026-3083 HIGH

CVE-2026-3084 HIGH

CVE-2026-3086 HIGH

More in Gstreamer

View all

CVE-2016-9636 CRITICAL Emergency POC

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9635 CRITICAL Emergency POC

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9634 CRITICAL Emergency POC

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer

CVE-2016-9808 HIGH This Week POC

The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write an

CVE-2019-9928 HIGH Act Now

A heap-based buffer overflow vulnerability exists in GStreamer's RTSP connection parser that allows remote attackers to

CVE-2025-47219 HIGH This Week POC

A heap buffer over-read vulnerability exists in GStreamer's isomp4 plugin that allows reading past allocated memory boun

CVE-2022-1920 HIGH This Week POC

An integer overflow vulnerability in the GStreamer multimedia framework's matroska demuxer allows heap memory corruption

CVE-2022-2122 HIGH This Week POC

A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service o

CVE-2022-1924 HIGH This Week POC

A critical integer overflow vulnerability in the GStreamer multimedia framework's Matroska (MKV) demuxer can cause denia

CVE-2022-1922 HIGH This Week POC

An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory

CVE-2022-1921 HIGH This Week POC

An integer overflow vulnerability in GStreamer's AVI demux element allows attackers to trigger a heap overwrite when par

CVE-2022-1925 HIGH This Week POC

A heap overflow vulnerability exists in GStreamer's matroskaparse element due to an integer overflow in the gst_matroska

Same weakness CWE-122 – Heap-based Buffer Overflow

View all

CVE-2023-4911 HIGH POC

CVE-2023-27997 CRITICAL

CVE-2026-94127 CRITICAL POC

CVE-2025-25249 CRITICAL POC

CVE-2026-85880 HIGH POC

CVE-2025-24985 HIGH POC

CVE-2026-53362 HIGH POC

CVE-2025-21418 HIGH

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

CVE-2017-7269 CRITICAL POC

CVE-2022-47966 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2023-3519 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2016-4117 CRITICAL POC

CVE-2015-3113 CRITICAL POC

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Liberty Linux 10	Fixed
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:6259 ADVISORY https://access.redhat.com/errata/RHSA-2026:6300 ADVISORY https://access.redhat.com/errata/RHSA-2026:6750 ADVISORY https://access.redhat.com/errata/RHSA-2026:7673 ADVISORY https://access.redhat.com/errata/RHSA-2026:7850 ADVISORY https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d60a94dee3c0a0942c9981491bf83e0de1900fbf ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-3085 ADVISORY https://vuldb.com/?id.349627 REF https://access.redhat.com/errata/RHSA-2026:19024 REF https://access.redhat.com/errata/RHSA-2026:19180 REF https://access.redhat.com/errata/RHSA-2026:8854 REF https://access.redhat.com/errata/RHSA-2026:8857 REF https://access.redhat.com/errata/RHSA-2026:8862 REF https://access.redhat.com/errata/RHSA-2026:8874 REF https://access.redhat.com/errata/RHSA-2026:8876 REF https://access.redhat.com/errata/RHSA-2026:9446 REF https://access.redhat.com/errata/RHSA-2026:9447 REF https://access.redhat.com/errata/RHSA-2026:9487 REF https://access.redhat.com/errata/RHSA-2026:9488 REF https://access.redhat.com/security/cve/CVE-2026-3085 REF https://bugzilla.redhat.com/show_bug.cgi?id=2447495 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3085.json REF https://www.zerodayinitiative.com/advisories/ZDI-26-167/

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy