GStreamer EUVD-2026-36805

Exploitation requires that the target system have gst-plugins-bad installed with AV1 decoding support enabled (the default on supported RHEL versions), and that a user open or stream a specially crafted AV1 media file from an attacker-controlled source. The user interaction requirement (UI:R in the CVSS vector) is a concrete prerequisite - passive network exposure alone is insufficient; the file must be actively opened by a user or automatically rendered by an application (e.g., a media thumbnail generator or auto-playing web content). Exploitation is limited to a process crash (DoS); no privilege escalation or code execution is possible based on the described vulnerability class (CWE-617 assertion abort). The impact is further bounded to the process handling the media file and does not affect the broader system or other users (S:U, unchanged scope). RHEL systems running in SELinux enforcing mode contain the crash to the affected process context.

The CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H accurately reflects a network-reachable, low-complexity DoS requiring only that a user open a malicious file - a realistic phishing or drive-by scenario. The impact is strictly availability (A:H); confidentiality and integrity are unaffected, which limits the blast radius. The mandatory user interaction (UI:R) is the primary friction point for exploitation at scale. No EPSS score was provided in the input data; EPSS cannot be independently assessed here. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept code has been identified at time of analysis. SSVC signals: exploitation status is 'none publicly known,' the vulnerability is potentially automatable via media file delivery (e.g., email attachment, web content), and technical impact is partial (process crash only, no code execution). Overall, this is a genuine medium-priority issue for systems that process AV1 content from untrusted sources - elevated for media players, video conferencing, and browser-adjacent applications - but a lower priority where AV1 handling is absent or restricted to trusted content.

An attacker crafts a malicious AV1 video file with a Tile List OBU whose field values exploit the byte/bit unit mismatch in gst_av1_parser_parse_tile_list_obu(), then delivers it to a target via email attachment, a malicious website embedding AV1 video, or a shared document. When the user opens the file in any GStreamer-backed application (e.g., a video player, browser with GStreamer integration, or video conferencing client), the parser desynchronizes and triggers an assertion abort, crashing the application. No public proof-of-concept exists at time of analysis, but the attack requires no special tooling beyond a crafted media file.