CVE-2026-3083 is a critical remote code execution vulnerability in GStreamer's rtpqdm2depay component. The vulnerability arises from improper validation of the packetid element in X-QDM RTP payloads, leading to an out-of-bounds write past the end of an allocated array. Exploitation requires interaction with the vulnerable library, and successful exploitation allows execution of arbitrary code in the context of the current process. The Zero Day Initiative assigned a CVSS score of 8.8 and coordinated public disclosure on March 6, 2026. GStreamer has released a patch to fix this vulnerability, as detailed in their official commit.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on affected systems running GStreamer, potentially leading to full compromise of the process using the vulnerable library. The vulnerability affects confidentiality, integrity, and availability (all rated high). No known exploits in the wild have been reported at the time of disclosure.

An official patch has been released by GStreamer to correct this vulnerability. Users and administrators should apply the update provided by GStreamer as soon as possible to remediate the issue. The vendor advisory and commit at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d60a94dee3c0a0942c9981491bf83e0de1900fbf contain the remediation details. No additional mitigations are specified or required beyond applying the official fix.