GStreamer gst-plugins-ugly EUVD-2026-36801

Exploitation requires (1) the gst-plugins-ugly package containing the RealMedia demuxer to be installed and used to process the file - it is not part of a minimal RHEL server install and is typically present only on workstation/desktop profiles, (2) the victim or an automatic component (media player, file-manager thumbnailer such as tumbler/tracker-miner, browser plugin) to actually open or probe a .rm file supplied by the attacker (UI:R in the CVSS vector), and (3) the malicious file to contain an MDPR chunk advertising audio header version 4 or 5 that is sized smaller than a complete audio stream header so that fixed-offset reads land past the buffer end. No authentication to the target system is required (PR:N), and no special non-default GStreamer configuration is needed - the vulnerable code path is the default RealMedia parsing logic.

The NVD-style CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, 7.1) reflects that a remote attacker need only deliver a crafted .rm file and convince a user to open it, after which they reliably crash the media pipeline (A:H) and may leak limited memory (C:L). However, real-world risk is meaningfully lower than the headline 7.1 suggests: there is no public exploit identified at time of analysis, the CVE is not on CISA KEV, EPSS data was not provided, and the demuxer is in gst-plugins-ugly, which is not installed in default minimal RHEL server profiles and is most commonly present on workstation/desktop deployments. The information-disclosure component is opportunistic - leaked bytes are whatever happens to sit after the truncated chunk in the heap, not attacker-controlled - so this is best treated as a desktop denial-of-service issue with a secondary, low-fidelity leak rather than a priority RCE-class bug. Note also that no Red Hat fix-version or errata is referenced in the input, only the CVE tracker and Bugzilla entry, so patch status is data-incomplete and should be re-checked before any urgency downgrade.

An attacker emails or hosts a crafted RealMedia file with a deliberately truncated MDPR chunk and lures a desktop user on RHEL with gst-plugins-ugly installed into opening or previewing it in a GStreamer-backed player or file-manager thumbnailer. The demuxer reads past the end of the chunk, crashing the media pipeline and terminating the player; in a more careful attack, the attacker repeatedly delivers files and harvests the small slices of adjacent heap memory that GStreamer exposes via stream metadata (caps/tags) to gradually leak sensitive process data. No public exploit code is identified at time of analysis.