GStreamer gst-plugins-ugly EUVD-2026-36802

Exploitation requires (1) the gst-plugins-ugly package with the RealMedia rmdemux element installed and enabled on the target, (2) the victim to open, preview, thumbnail, or otherwise feed a maliciously crafted RealMedia (.rm) container into a GStreamer pipeline (CVSS UI:R), and (3) the FILEINFO metadata section to be parsed, which is part of normal RealMedia demuxing so no non-default configuration is needed. No authentication is required on the target (PR:N), but the attacker must deliver the file (network vector via web download, email attachment, USB, or shared filesystem). Headless servers without GStreamer media playback, and desktops where gst-plugins-ugly is not installed (it is an optional 'ugly' codec set), are not exposed.

The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H (7.1 High) accurately captures the dominant risk: availability impact is High (crash/hang), confidentiality is Low (only limited adjacent memory may be read), and exploitation requires user interaction - typically opening or auto-thumbnailing a malicious .rm file. No EPSS score, KEV listing, or public PoC was provided in the intelligence, which is consistent with a recently disclosed Red Hat-reported issue rather than a mass-exploited bug; treat the network attack vector as 'attacker delivers a file' rather than unauthenticated remote code execution. The realistic priority is moderate: ubiquitous library, easy delivery via web/email, but capped impact (DoS plus narrow info-leak, not RCE), so patch on the normal Linux distribution cadence rather than as an emergency.

An attacker hosts or emails a crafted RealMedia (.rm) file with a malformed FILEINFO section; when a Linux user opens it in any GStreamer-backed player (Totem, Rhythmbox, Clementine, browser <video> via GStreamer) - or merely browses a directory whose file manager auto-thumbnails the file - rmdemux either spins in an infinite loop and freezes the application or reads past the buffer end, crashing the process and possibly exposing a small amount of adjacent heap memory in error messages or downstream pipeline elements. The CVSS UI:R requirement means exploitation depends on the victim triggering media handling, but this is trivially achieved through normal desktop workflows.