CVE-2026-18298 is a heap-based buffer overflow vulnerability in GStreamer's PNG file parser. The vulnerability occurs due to insufficient validation of the length of user-supplied data prior to copying it into a heap buffer, enabling remote attackers to execute arbitrary code within the context of the affected process. Exploitation requires user interaction, such as opening a crafted PNG file or visiting a malicious webpage. The Zero Day Initiative assigned a CVSS score of 7.8 and classified the severity as critical. GStreamer has released an update to fix this vulnerability as per their security advisory SA-2026-0052.

Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the user running GStreamer. This can lead to full compromise of the affected system or application. The vulnerability requires user interaction, limiting automatic exploitation. The CVSS vector indicates low attack complexity and no privileges required, but user interaction is necessary. Confidentiality, integrity, and availability impacts are all rated high.

GStreamer has issued an official update that corrects this vulnerability. Users and administrators should apply the update provided by GStreamer as detailed in their security advisory (https://gstreamer.freedesktop.org/security/sa-2026-0052.html) to remediate this issue. No additional mitigations are indicated by the vendor advisory.