CVE-2026-3081 is a stack-based buffer overflow vulnerability in the H.266 codec parser component of GStreamer. The vulnerability occurs due to insufficient validation of the length of user-supplied data before copying it into a fixed-length stack buffer during parsing of decoding units. This can lead to remote code execution in the context of the current process if exploited. Interaction with the GStreamer library is required for exploitation, and attack vectors depend on how the library is used in different implementations. The Zero Day Initiative assigned a CVSS score of 7.8 and coordinated public disclosure on March 6, 2026. GStreamer has released an update to fix this issue, with details available in their official commit.

Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the affected process, potentially leading to full compromise of the application using GStreamer. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits in the wild have been reported at the time of disclosure.

GStreamer has issued an official update that corrects this vulnerability. Users and administrators should apply the provided update from the GStreamer project to remediate this issue. Since the vendor has released a fix, applying this official patch is the recommended mitigation. Patch status is confirmed by the vendor advisory linked in the source content.